Updated: 28 September 2026 · Applies to: Apache 2.4 (.htaccess)
Your .htaccess file contains your site's rewrite and security rules, so it should never be downloadable. Apache blocks files starting with .ht by default on our servers; you can add the rule yourself as extra protection.
Add to .htaccess
<Files ~ "^\.ht">
Require all denied
</Files>
Test it by opening https://yourdomain.com/.htaccess: you should get a "403 Forbidden" error.
Note: The older Order allow,deny / Deny from all syntax is from Apache 2.2. It still works through a compatibility module, but use Require on Apache 2.4.
