What .htaccess rules improve security?

The .htaccess file in your site's root folder lets you add server-level protections. Here are some useful, safe rules for a typical site.

Force HTTPS:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Protect sensitive files (for example WordPress config):

<Files wp-config.php>
  Require all denied
</Files>

Disable directory browsing so visitors cannot list your folders:

Options -Indexes

Block access to .htaccess itself and hidden files:

<FilesMatch "^\.">
  Require all denied
</FilesMatch>

Add basic security headers:

Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"

Edit .htaccess via the File Manager in the DirhamHost panel at my.dirhamaday.ae. Always keep a copy of the original before editing, because a syntax mistake can cause a 500 error; if that happens, restore the previous version. Want us to review your rules? Contact WhatsApp +971 58 553 6767 or support@dirhamaday.ae.