Why .htaccess Is Hidden by Default
Any name that starts with a dot is a hidden file on Linux, and File Manager follows that rule. The file is usually already in the document root. You are looking at a filtered list, not an empty account.
- File Manager is hiding dotfiles, which is the usual case.
- Nothing has created the file yet, which is common on a new HTML site or on WordPress still using plain permalinks.
- You can see the file, but Edit returns HTTP 401 and the words Security Token. That is ownership or a stale session, not a missing file.
A folder inside the site can hold its own .htaccess. That copy applies only to URLs under that folder and overrides the parent file for those requests. PHP does not store this file. Apache and LiteSpeed read it, and nginx ignores it.
Step 1: Turn On 'Show Hidden Files'
Turn the filter off in the File Manager you are already using. You know it worked when the list reloads and other dotfiles appear, even if .htaccess itself is not among them.
- Log in to cPanel and open Files, then File Manager.
- Click Settings at the top right.
- Tick Show Hidden Files (dotfiles), then click Save.
- Scan the list for names that start with a dot.
The choice is stored for that File Manager session on many cPanel builds, so a later login can hide the file again. An FTP client hides dotfiles the same way. Turn on its show-hidden option, or the folder looks empty there too.
Step 2: Navigate to public_html or the Addon Folder
Open the document root for the domain you are fixing. On cPanel the main domain uses public_html. Every other domain uses the directory printed beside it under Domains.
| Site | Folder that holds .htaccess | How you confirm the folder |
|---|---|---|
| Main domain | public_html | Domains lists the document root as public_html |
| Addon domain | The addon directory, inside public_html or next to it | The path under Domains matches the folder you opened |
| Subdomain | The subdomain directory | Same Domains list, not the main public_html file |
| App in a subfolder | That subfolder, and public_html if the main site has its own file | The subfolder file controls only URLs under it |
If a save does not change the live site, you edited the wrong root. Go back to Domains and open the path printed there before you change another line.
If .htaccess Doesn't Exist (Creating It)
With hidden files on, an empty list means the file was never written. Click +File, type .htaccess with the leading dot and no extra extension, and create it in the document root you confirmed above.
On WordPress, do not start from a blank file. Open Settings, then Permalinks, and click Save Changes. WordPress writes its permalink rules when the folder is writable. If the screen says the file is not writable, set the folder to 755 and click Save again.
Do not paste rewrite rules copied from another site into that new file. A block written for a different folder layout is a common way to take the site offline. What belongs in the file, after you have a copy, is in the .htaccess edit guide.
Backing Up Before Any Edit
Copy the file before you change a byte. Right-click .htaccess, choose Copy, and name the copy .htaccess.bak in the same folder. Download a second copy to your computer.
To open it, right-click the original and choose Edit. If an encoding box appears, click Edit again. That second click only opens the editor. Click Save Changes, then load the home page in a private window.
If you can see the file but View or Edit returns HTTP 401 with Security Token, stop retrying. Rename it to .htaccess.txt. If the rename also fails, your cPanel user does not own the file. Email support@webji.services with the domain and the 401 text.
The 500-Error Link to Broken .htaccess
Apache and LiteSpeed read this file on every request in the folder. One bad line returns 500 for the whole site, including wp-admin, usually in the minute after a save.
Rename .htaccess to .htaccess.off and reload the home page. If the site comes back, the file was the cause. Put .htaccess.bak back, change one line, and test again. Other causes are in the 500 error guide for cPanel hosting.
Restoring or Regenerating the File
To put a known-good file back, rename .htaccess.bak to .htaccess, or upload the copy you downloaded. Reload once in a private window before you add anything new.
WordPress can rebuild its own block. Leave hidden files on, open Settings, then Permalinks, and click Save Changes. Rules you added survive only outside the BEGIN WordPress and END WordPress markers, because that save rewrites the block between them.
An empty .htaccess is a valid file when you only need the name to exist. Add rules from the edit guide one at a time, and keep the .bak copy until the site has stayed up.
Frequently Asked Questions
Where is the .htaccess file located in cPanel?
It is in the document root. The main domain uses public_html. An addon domain or a subdomain uses the folder listed beside that name under Domains. Open that folder after hidden files are turned on.
Why can't I see .htaccess in cPanel File Manager?
The name starts with a dot, so File Manager hides it by default. Open Settings at the top right, tick Show Hidden Files (dotfiles), and click Save. If it is still absent, the file has not been created.
How do I show hidden files in File Manager?
In File Manager, click Settings at the top right, tick Show Hidden Files (dotfiles), and click Save. The file list reloads. Names that start with a dot, including .htaccess, then show when the file exists.
What if my site has no .htaccess file at all?
Click +File in the document root and name the new file .htaccess, with the dot and no other extension. On WordPress, open Settings, then Permalinks, and click Save Changes so WordPress writes the file when the folder is writable.
How do I back up .htaccess before editing it?
In File Manager, right-click the file, choose Copy, and name the copy .htaccess.bak in the same folder. Download a second copy to your computer before you choose Edit.
Can a wrong .htaccess cause a 500 error?
Yes. The server reads the file on every request in that folder, so one bad line returns 500 for the whole site. Rename it to .htaccess.bak and reload. If the site returns, restore the backup and fix the last line you changed.
What is the .htaccess file for?
It holds Apache or LiteSpeed rules for one folder: redirects, rewrites, access limits, and headers. It does not replace the main server config. Nginx does not read the file.