A Simple .htaccess Security Fix Many Small Business Sites Miss

If a website runs on Apache, .htaccess is often treated like a place to handle redirects and basic rewrite rules. But it can also provide a useful layer of defensive hardening, especially for smaller business websites that may not have dedicated infrastructure engineering behind them.

One of the most practical steps is blocking direct access to files that should never be publicly accessible.

The files people forget about

This usually includes:

• .env
• composer.json
• composer.lock
• .git
• backup files
• database dumps
• log files

These files are not meant for visitors. They are operational artifacts. If one becomes accessible through a server misconfiguration or deployment mistake, the result can be serious.

Why this is dangerous

Exposed configuration files can reveal:

• database hostnames
• usernames and passwords
• mail credentials
• API tokens
• application environment settings
• package and dependency details

Attackers do not always need a sophisticated exploit. Sometimes they only need a site that accidentally exposes something useful.

A practical rule

Here is a simple example:

<FilesMatch "^(\.env|composer\.(json|lock)|.*\.log|.*\.bak|.*\.sql)$">
    Require all denied
</FilesMatch>

This is not a complete security strategy, but it is a meaningful layer.

Security works best in layers

.htaccess hardening is most effective when combined with:

• correct web root configuration
• secure deployment practices
• regular updates
• backup discipline
• monitoring and alerting

For example, Laravel apps should ideally expose only the public directory through the web server. But even if that is already done correctly, adding defensive rules can still reduce the impact of future mistakes.

Common small-business reality

Many small business sites evolve over time. A new plugin is added, hosting is changed, a backup is dropped into the wrong directory, or an old developer leaves behind extra files. That is exactly why these protections matter. They are inexpensive and they reduce the blast radius of human error.

Final takeaway

Good security is often a series of practical habits rather than one dramatic fix. If your site is important to the business, taking a few minutes to harden Apache access rules is worth it.