Hardening cPanel with a Custom “Pre Main Virtual Host Include”

Every WordPress and PHP site tends to leak a predictable set of files: .git folders, .env files, backup copies, lockfiles, log files. None of it should be reachable from the browser, but by default, plenty of it is. cPanel lets you fix this globally with a pre main virtual host include — a config snippet that applies to every account on the server, before the main vhost config loads. Here’s the one I use.

#
# Block access to Git metadata
#
<FilesMatch "^\.git">
    Require all denied
</FilesMatch>
#
# Block common WordPress information endpoints
#
<FilesMatch "^(xmlrpc\.php|readme\.html|license\.txt)$">
    Require all denied
</FilesMatch>
#
# Block sensitive files
#
<FilesMatch "\.(env|git|gitignore|gitattributes|lock|md)$">
    Require all denied
</FilesMatch>
#
# Block backup, temporary, log and source files
#
<FilesMatch "(^#.*#|\.(bak|conf|dist|fla|inc|ini|log|old|orig|psd|save|sh|sql|swo|swp|tmp|temp)|~)$">
    Require all denied
</FilesMatch>
#
# Block common dependency and package manager files
#
<FilesMatch "^(composer\.(json|lock)|package(-lock)?\.json|yarn\.lock|pnpm-lock\.yaml)$">
    Require all denied
</FilesMatch>
#
# Explicitly block any .env variants
#
<FilesMatch "^\.env.*$">
    Require all denied
</FilesMatch>

# Required for our custom log rotate config
<FilesMatch "^error_log(\.[0-9]+)?$">
    Require all denied
</FilesMatch>