Editing your .htaccess file in public_html (via cPanel File Manager) adds server-level protection. Back it up first.
- Protect wp-config.php:
<Files wp-config.php>Require all denied</Files> - Block PHP execution in uploads: add an
.htaccessinwp-content/uploadswith<Files *.php> Require all denied </Files>. - Disable directory browsing: add
Options -Indexes.
You can also restrict wp-login.php to your IP and protect /wp-admin with cPanel's Directory Privacy. Combine this with strong passwords, updates, and a security plugin. Test your site after each change, since a wrong rule can cause errors. If something breaks, open a ticket.
