.htaccess security rules: block IPs, disable directory listing and restrict folders

The .htaccess file lets you control access to your website folder by folder, without server root access. MdmHost runs LiteSpeed, which reads Apache .htaccess rules, so the examples below work as written. Rules in a folder apply to that folder and everything below it.

Before you start

• Open cPanel → Files → File Manager, click Settings (top right) and tick Show Hidden Files (dotfiles). See editing .htaccess in File Manager for details.
• Download a copy of the current .htaccess before you change it. One typing error causes a 500 Internal Server Error for the whole site.
• Find your own IP with the IP checker.

Block one or more IP addresses

Add this to public_html/.htaccess, replacing the example addresses:

<RequireAll>
  Require all granted
  Require not ip 203.0.113.25
  Require not ip 198.51.100.0/24
</RequireAll>

This is the modern Apache 2.4 syntax. Old guides use Order Deny,Allow and Deny from; those still work in most setups but should not be mixed with Require lines in the same file. For a point-and-click version use cPanel IP Blocker.

Allow only your IP into a folder

Useful for an admin area or staging folder. Create .htaccess inside that folder (for example public_html/admin):

Require ip 203.0.113.25 198.51.100.7

Everyone else gets 403 Forbidden. If your home IP changes often, use password protection instead.

Disable directory browsing

Without an index file, the server may list every file in a folder. Turn that off for the whole site:

Options -Indexes

cPanel offers the same under Advanced → Indexes: choose a folder and select No Indexing.

Protect .htaccess and sensitive files

<FilesMatch "^(\.htaccess|\.htpasswd|\.env|wp-config\.php|php\.ini|\.user\.ini)$">
  Require all denied
</FilesMatch>

The server already hides .ht* files by default; this rule adds environment and config files and protects you if defaults change.

Block access to file types in uploads

Stop PHP from running inside an uploads folder, a common malware trick. Create .htaccess in public_html/wp-content/uploads:

<FilesMatch "\.(php|phtml|phar)$">
  Require all denied
</FilesMatch>

Stop image hotlinking

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?example\.com/ [NC]
RewriteRule \.(jpe?g|png|gif|webp)$ - [F,NC,L]

Replace example\.com with your domain (keep the backslash before the dot).

Check your rules

• Reload the site in a private window; it should load normally.
• Test a blocked case, for example open a folder without an index file: you should see 403.

Troubleshooting

• 500 Internal Server Error: restore the backup copy, then add rules one at a time. cPanel → Metrics → Errors shows the exact line that failed.
• Rule seems ignored: a later rule or a plugin block may override it; place security rules at the top, outside # BEGIN WordPress markers.
• Locked yourself out of a folder: edit or delete that folder's .htaccess in File Manager.

Next steps

• Rewrite rules and friendly URLs in .htaccess
• Force HTTPS for your site
• Harden WordPress