Your .htaccess Files
Finally Work with OpenLiteSpeed
Stop rewriting Apache rules. Stop breaking sites during migration.
PHP config, headers, redirects, access control + WordPress brute force protection - everything works instantly.
- Hours spent rewriting Apache rules
- PHP settings don't work in .htaccess
- Broken sites after migration
- No built-in brute force protection
- Security headers don't work
- Redirects break completely
- One-command installation
- PHP settings work perfectly
- Works instantly on upload
- Built-in WordPress brute force protection
- All security headers work
- Redirects work with regex
WordPress Brute Force Protection
Protect your WordPress sites from credential stuffing and brute force attacks with progressive throttling - slow down attackers while letting legitimate users through.
Enable with One Line
BruteForceProtection On
Progressive Throttle System
Attackers get progressively slower responses - making brute force attacks impractical
# Production-Ready Configuration BruteForceProtection On BruteForceAllowedAttempts 5 BruteForceWindow 300 BruteForceAction throttle # Behind Cloudflare/Proxy BruteForceXForwardedFor On # Whitelist trusted IPs BruteForceWhitelist 10.0.0.0/8, 192.168.1.0/24 # Protect custom admin areas BruteForceProtectPath /admin/ BruteForceProtectPath /api/login
Your Existing .htaccess Just Works
No changes needed. Upload and it works.
# Your Apache .htaccess file
Header set X-Frame-Options "SAMEORIGIN"
Header set X-Content-Type-Options "nosniff"
RequestHeader set X-Forwarded-Proto "https"
# PHP Configuration
php_value memory_limit 768M
php_value upload_max_filesize 150M
php_flag display_errors On
# Brute Force Protection
BruteForceProtection On
SetEnv APPLICATION_ENV production
SetEnvIf User-Agent ".*Mobile.*" mobile_device
ErrorDocument 404 /404.html
Order deny,allow
Deny from all
Allow from 192.168.1.0/24
Redirect 301 /old /new
RedirectMatch 301 ^/blog/(.*)$ /news/$1
ExpiresActive On
ExpiresByType image/jpeg A31557600
<FilesMatch "\.(css|js)$">
Header set Cache-Control "max-age=2592000"
</FilesMatch>
# Result: None of this works in OpenLiteSpeed!
# Same exact .htaccess file
Header set X-Frame-Options "SAMEORIGIN"
Header set X-Content-Type-Options "nosniff"
RequestHeader set X-Forwarded-Proto "https"
# PHP Configuration - NOW WORKS!
php_value memory_limit 768M
php_value upload_max_filesize 150M
php_flag display_errors On
# Brute Force Protection - NOW WORKS!
BruteForceProtection On
SetEnv APPLICATION_ENV production
SetEnvIf User-Agent ".*Mobile.*" mobile_device
ErrorDocument 404 /404.html
Order deny,allow
Deny from all
Allow from 192.168.1.0/24
Redirect 301 /old /new
RedirectMatch 301 ^/blog/(.*)$ /news/$1
ExpiresActive On
ExpiresByType image/jpeg A31557600
<FilesMatch "\.(css|js)$">
Header set Cache-Control "max-age=2592000"
</FilesMatch>
# Result: Everything works instantly!
PHP Configuration Now Works in .htaccess
We achieved what was previously considered impossible in OpenLiteSpeed - full php_value and php_flag support. Configure PHP settings per directory without editing php.ini or restarting PHP.
# Just add to your .htaccess - works instantly! php_value memory_limit 768M php_value upload_max_filesize 150M php_value post_max_size 150M php_value max_execution_time 600 php_flag display_errors On php_value date.timezone "America/New_York" php_admin_flag allow_url_fopen Off
Everything You Need for Smooth Migration
Complete Apache compatibility + WordPress security
Brute Force Protection
Built-in WordPress protection with progressive throttling. Slow down attackers with 2s/5s/15s delays while letting legitimate users through.
Instant Activation
No configuration needed. Install once and all your .htaccess files start working immediately across all sites.
PHP Configuration
Breakthrough feature! Full php_value and php_flag support. Configure PHP settings per directory - previously impossible in OpenLiteSpeed.
Security Headers
All your security headers work perfectly. X-Frame-Options, CSP, HSTS - everything functions as expected.
Access Control
IP whitelisting, blacklisting, and network restrictions work exactly like Apache. Protect your admin areas effortlessly.
Custom Error Pages
Your custom 404, 500, and other error pages display properly. No more broken error handling.
Auto-Updates
Detects changes to .htaccess files automatically. No need to restart or reload - changes apply instantly.
Zero Performance Impact
Optimized caching ensures less than 0.5ms overhead. Get compatibility without sacrificing speed.
Redirect Support
Full support for Redirect and RedirectMatch directives with regex patterns and capture groups for URL rewrites.
FilesMatch Support
Apply headers based on file patterns with regex matching. Perfect for setting cache headers on specific file types.
Expires Directives
Complete mod_expires compatibility with ExpiresActive and ExpiresByType. Automatic Cache-Control headers.
Environment Variables
SetEnv, SetEnvIf, and BrowserMatch directives with conditional logic. Set $_SERVER variables based on request properties.
Full Apache .htaccess Compatibility + Security
All the directives you need, including breakthrough PHP configuration and brute force protection
WordPress Brute Force Protection 🛡️ NEW in v2.2.0
Built-in protection against credential stuffing and brute force attacks with progressive throttling. Protects wp-login.php, xmlrpc.php, and custom paths. Supports IP whitelisting with CIDR notation and X-Forwarded-For for proxy/CDN setups.
# Enable brute force protection BruteForceProtection On BruteForceAllowedAttempts 5 BruteForceWindow 300 BruteForceAction throttle # Behind Cloudflare/proxy BruteForceXForwardedFor On # Whitelist trusted IPs (CIDR supported) BruteForceWhitelist 10.0.0.0/8, 192.168.1.0/24, 203.0.113.100 # Protect custom admin areas BruteForceProtectPath /admin/ BruteForceProtectPath /api/login # Actions: block (403), log (allow but log), throttle (progressive delays) # Throttle levels: soft (2s), medium (5s), hard (15s)
Header Directives ✅ Fully Supported
Complete support for all header manipulation directives including set, unset, append, merge, and add operations. Perfect for security headers, CORS, cache control, and custom headers.
# Security Headers Header set X-Frame-Options "SAMEORIGIN" Header set X-Content-Type-Options "nosniff" Header set Strict-Transport-Security "max-age=31536000" # CORS Headers Header set Access-Control-Allow-Origin "*" Header set Access-Control-Allow-Methods "GET, POST, OPTIONS" # Cache Control Header set Cache-Control "public, max-age=3600" # Remove Headers Header unset X-Powered-By # Append to Existing Header append Vary "Accept-Encoding"
PHP Configuration (php_value/php_flag) ✅ Breakthrough Feature!
Revolutionary feature previously considered impossible in OpenLiteSpeed! Configure PHP settings directly in .htaccess just like Apache. Set memory limits, upload sizes, error handling, timezones, and more on a per-directory basis without editing php.ini or restarting PHP.
# Memory and Upload Limits php_value memory_limit 768M php_value upload_max_filesize 150M php_value post_max_size 150M php_value max_execution_time 600 php_value max_input_time 600 # Error Handling and Logging php_flag display_errors On php_flag log_errors On php_admin_value error_log /var/log/php-errors.log # Security Settings php_admin_flag allow_url_fopen Off php_admin_flag allow_url_include Off # Date and Time php_value date.timezone "America/New_York" php_value default_charset "UTF-8" # Session Configuration php_value session.gc_maxlifetime 7200 php_flag session.use_strict_mode On
Access Control ✅ Fully Supported
Complete IP-based access control with Order, Allow, and Deny directives. Supports individual IPs and CIDR ranges for flexible network-level security.
# Whitelist Approach - Block all except allowed Order deny,allow Deny from all Allow from 192.168.1.0/24 Allow from 10.0.0.5 # Blacklist Approach - Allow all except denied Order allow,deny Allow from all Deny from 203.0.113.0/24 # Complex Rules Order deny,allow Deny from all Allow from 192.168.0.0/16 # Internal network Allow from 10.0.0.0/8 # VPN Allow from 172.16.0.0/12 # Private subnet
Redirect Directives ✅ Fully Supported
Full support for Redirect and RedirectMatch directives with regex patterns and capture groups. Perfect for URL migrations, enforcing trailing slashes, or redirecting old URLs to new locations.
# Simple Redirects Redirect 301 /old-page /new-page Redirect permanent /old-url https://new-domain.com/page # Regex Pattern Matching with RedirectMatch RedirectMatch 301 ^/blog/(.*)$ /news/$1 RedirectMatch permanent ^/products/(.+)\.html$ /shop/$1 # Enforce trailing slashes RedirectMatch 301 ^/(.+[^/])$ /$1/ # Category redirects with capture groups RedirectMatch 301 ^/category/([^/]+)/page/([0-9]+)$ /cat/$1?p=$2
ErrorDocument, FilesMatch, Expires, SetEnv ✅ All Supported
Plus full support for ErrorDocument custom error pages, FilesMatch pattern-based headers, Expires (mod_expires) browser caching, SetEnv/SetEnvIf environment variables, RequestHeader for proxy configurations, and BrowserMatch for User-Agent detection.
# Custom Error Pages
ErrorDocument 404 /errors/404.html
ErrorDocument 500 /errors/500.html
# Cache Control for Static Files
<FilesMatch "\.(jpg|png|gif|css|js)$">
Header set Cache-Control "max-age=31536000"
</FilesMatch>
# Expires Directives
ExpiresActive On
ExpiresByType image/jpeg A31557600
ExpiresByType text/css A2592000
# Environment Variables
SetEnv APPLICATION_ENV production
SetEnvIf User-Agent ".*Mobile.*" mobile_device
BrowserMatch "MSIE" old_browser
# Request Headers
RequestHeader set X-Forwarded-Proto "https"
One Module, Unlimited Sites
Now with WordPress Brute Force Protection included!
1 Year
2 Years
3 Years
Trusted by Server Administrators
See what our users are saying
Migrated 50+ WordPress sites from Apache to OpenLiteSpeed in one afternoon. This module saved us weeks of work rewriting rules.
The brute force protection is a game-changer. We used to rely on WordPress plugins, but having it at the server level is much more secure and efficient.
Worth every penny. No more explaining to clients why their .htaccess doesn't work after migration. It just works.
The PHP configuration support is amazing! I can now set memory limits and upload sizes per directory without touching php.ini. This feature alone is worth the price.
Frequently Asked Questions
Everything you need to know
Documentation & Support
Everything you need to succeed
Documentation
Comprehensive guides covering installation, configuration, brute force protection, and troubleshooting for all supported directives.
View Docs →Community Forum
Join thousands of CyberPanel users discussing best practices, sharing tips, and helping each other.
Join Community →GitHub Repository
Access source code, view comprehensive test results, report issues, and see detailed documentation.
View on GitHub →Stop Fighting with .htaccess Files
Join hundreds of administrators who've made migration painless.
Now with PHP configuration + WordPress brute force protection!
