If you keep finding .htaccess files appearing in directories you did not create, they are almost always generated by cPanel, your CMS (WordPress, Joomla), or a security tool, and they serve important purposes. Occasionally, though, a malicious .htaccess is injected by malware, so it is worth knowing how to tell the difference.
cPanel and applications create .htaccess files automatically
cPanel writes .htaccess files when you enable password protection, change the PHP version, add redirects, or turn on hotlink protection. WordPress, Joomla, and other platforms create and modify them for permalinks, caching, and security. These files are supposed to be there.
01. What Creates Them
- cPanel - password-protected directories, PHP handler settings, redirects, hotlink protection, and index settings.
- WordPress - the Settings then Permalinks page writes rewrite rules to .htaccess.
- Security plugins - Wordfence, iThemes Security, and similar add firewall rules.
- Caching plugins - WP Super Cache, W3 Total Cache, and LiteSpeed Cache add caching directives.
- Server security - Imunify360 and ModSecurity may add protective rules.
02. Should You Delete Them?
Generally, no. Deleting a legitimate .htaccess can break your permalinks, disable security features, remove password protection, and undo PHP settings. To see what a file does, open it in cPanel File Manager (enable Show Hidden Files in Settings) and read it; most auto-generated rules include comments explaining their purpose.
03. Legitimate vs Malicious .htaccess
Malware sometimes drops or modifies an .htaccess to redirect your visitors to spam or to run malicious code. Signs a file is not legitimate:
- Unexplained redirects - RewriteRule lines sending visitors to an unknown external domain.
- Obfuscated code - long random strings, base64 blocks, or rules you cannot read.
- php_value auto_prepend_file pointing at a suspicious file you did not create.
- Files in odd places - an .htaccess in an uploads or cache folder with rewrite rules.
If you find any of these, your site may be compromised. Scan it with the security tools, change your passwords, and remove the malicious rules and files. Our WordPress Security guide covers cleanup.
04. Safe Handling
Before editing or deleting any .htaccess, make a backup copy. In cPanel File Manager, right-click the file and choose Copy to save it as something like .htaccess.bak so you can restore it if something breaks.
For the full range of what .htaccess can do, see the Complete Guide to .htaccess on Apache. If you cannot see .htaccess files in your FTP client, see When I Upload an .htaccess File It Disappears.
Not Sure About an .htaccess File?
If you find rules you do not recognize and want to know whether they are safe, open a ticket and paste the contents.
Open a Support TicketFrequently Asked Questions
Why do .htaccess files keep appearing in my account?
They are auto-generated by cPanel, your CMS, and plugins for things like permalinks, caching, redirects, and security. Finding them is normal; they are created whenever you enable a feature that needs rewrite or configuration rules.
Should I delete .htaccess files I did not create?
Generally no. Deleting a legitimate .htaccess can break permalinks, security, password protection, and PHP settings. Read the file first (it usually has comments), and back it up before changing anything.
How do I tell if an .htaccess file is malicious?
Watch for redirects to unknown external domains, obfuscated or base64 code, an auto_prepend_file pointing at a file you did not create, or an .htaccess with rewrite rules sitting in an uploads or cache folder. Any of these suggests a compromise.
What do I do if I find a malicious .htaccess?
Treat the site as compromised: scan it with the security tools, change your cPanel and application passwords, remove the malicious rules and any files they reference, then update everything. Open a ticket if you need help confirming it is clean.
Quick Recap
- Auto-generated by cPanel, WordPress, and plugins - usually normal.
- Do not delete legitimate files; read them first and back up.
- Watch for malware signs - odd redirects, obfuscated code, auto_prepend_file.
- Enable Show Hidden Files in File Manager to see them.
- Suspicious rules? Scan, change passwords, and open a ticket.
Understanding .htaccess on your hosting account · Last updated November 2026 · Browse all htaccess articles
