Website Security on Shared Hosting: Practical Guides
On shared hosting you do not control the server, so security comes down to what you can do inside your own account: .htaccess rules, correct HTTPS and headers, strong password hashing, spam-proof forms, email authentication so your domain cannot be spoofed, and backups you have actually restored once. These guides cover exactly those controls, each with the configuration you can paste and a way to verify it worked.
They are written for site owners and developers who maintain business websites and small SaaS apps, with the same approach used on HeadsNTail itself: block what should never be public, authenticate what you send, and keep the fix simple enough to maintain.
Start here
- cPanel Emails Going to Spam? Fix SPF, DKIM & DMARC — Fix cPanel emails going to spam in Gmail and Outlook. Check SPF, DKIM, DMARC, reverse DNS, shared IP reputation, and Laravel SMTP settings.
- Mitigate BREACH Without Saying Goodbye to Compression — How BREACH abuses gzip and Brotli on HTTPS, and how to protect Laravel apps with token masking, SameSite and selective compression, not gzip off.
- How to Solve Google v3 reCAPTCHA Timeout in PHP Forms — reCAPTCHA v3 tokens expire after two minutes. Here's how to request them at submit time in PHP, handle AJAX forms, and debug failed checks.
Free tools for this topic
All guides in this topic (7)
cPanel Emails Going to Spam? Fix SPF, DKIM & DMARC
Fix cPanel emails going to spam in Gmail and Outlook. Check SPF, DKIM, DMARC, reverse DNS, shared IP reputation, and Laravel SMTP settings.
Mitigate BREACH Without Saying Goodbye to Compression
How BREACH abuses gzip and Brotli on HTTPS, and how to protect Laravel apps with token masking, SameSite and selective compression, not gzip off.
How to Solve Google v3 reCAPTCHA Timeout in PHP Forms
reCAPTCHA v3 tokens expire after two minutes. Here's how to request them at submit time in PHP, handle AJAX forms, and debug failed checks.
Security Headers in .htaccess on cPanel: Fix Guide (2026)
Add security headers in .htaccess on cPanel: HSTS, CSP, X-Frame-Options and Permissions-Policy, with tests that catch duplicates and 500 errors.
X-Real-IP header confusion in nginx: fix the wrong IP
Your app logs the proxy IP instead of the visitor's? Here's how X-Real-IP, real_ip_header and set_real_ip_from fit together in nginx and Laravel.
Fix curl (35) ssl3_get_record:wrong version number on Nginx
Getting curl (35) wrong version number against Nginx? It means the port isn't speaking TLS. Here's how to confirm the cause and fix your config.
I Got "timeout-or-duplicate" Error Using reCAPTCHA v3: Fix
Fix the reCAPTCHA v3 "timeout-or-duplicate" error in Laravel: generate tokens at submit time, verify each token once, and debug with logs.
FAQ
Is shared hosting safe for a business website?
Yes, if the account itself is hardened: HTTPS forced, sensitive files blocked in .htaccess, strong hashing for stored passwords, forms protected against spam and regular off-site backups. The host secures the server; you secure the site.
What should .htaccess block on a PHP site?
Access to .env, .git, composer files, logs, backups and SQL dumps, directory listing, and HTTP (redirect to HTTPS). The .htaccess generator produces these rules for cPanel.
Does Cloudflare replace these steps?
No. Cloudflare adds a firewall and DDoS protection in front of the site, but .htaccess, hashing, email authentication and backups still have to be done on the account.