.htaccess is powerful and unforgiving. One wrong character takes the whole site down with a 500 error, so the first rule is always: take a copy before you edit it.
The mistakes we see most
Pasting rules from the internet without reading them
Rules written for a different setup – a different folder, a different server, WordPress in a subdirectory – will not work and can break what already worked.
Putting rules in the wrong order
WordPress's permalink block must come after most custom rules. Security plugins that write their own blocks can push it out of position. If pages 404 after adding rules, this is usually why.
Blocking the certificate validation path
A rule redirecting everything to https before /.well-known/ is reached breaks automatic certificate renewal – and you will not notice until the certificate expires weeks later.
Duplicated blocks
Some security plugins rewrite .htaccess repeatedly and can append their block again each time. We have seen a file containing dozens of copies of the same rules. If your .htaccess is thousands of lines, look for repetition before trying to understand it.
Editing on Windows
Some Windows editors add line endings the server does not expect, or save the file as htaccess.txt. Use cPanel's File Manager editor, which avoids both.
If the site goes down after an edit
Rename .htaccess to .htaccess-broken. The site will return immediately, minus whatever the file was doing. You can then work out what was wrong without the site being off.
