Hardening via htaccess – running not from root

I have my sites in sub-directories (sub-folders), and each has its own htaccess file written by BulletProof Security. I also have an htaccess file in my root directory for pointing traffic to my primary domain, and there is where I have my own initial “file deny” instructions. Ignoring the fact that I have add-on domains where you do not, my guess here is that you might disable your security program and see what happens. In my own case, I am the only one who ever writes to my root htaccess file, and BulletProof Security does not even know it is there while writing the individual-and-separate, site-specific htaccess files in my sub-directories. How your server handles pointing might be an issue here, and I think the problem is that your security is interfering with that handling.

Okay, thanks for that. I will talk to our hoster, maybe they got some answers for me.