Removing the dot or period from htaccess files and thus making it unhidden - A dangerous move?
You definitely have to be careful how you do it, as you might otherwise compromise the security of your server.
There are basically two dangers that you could encounter:
Reading your htaccess File
htaccess files are nothing special, and if you just rename
htaccess, anyone can now read it, as it will be served as a normal file by Apache. It doesn't matter here if you changed
AccessFileName or not. Access to
.htaccess is denied by these lines in your Apache config, which will not catch htaccess:
Require all denied
This may have negative consequences, such as leaking of information. Your htaccess file may for example contain absolute paths, and possibly other sensitive information such as database passwords defined via SetEnv.
htaccess File not working
Of course, if you rename your
.htaccess file, it will not be parsed anymore. This means that you have to change
But if you just change
AccessFileName .htaccess to
AccessFileName htaccess, this might be dangerous, as some other applications on the same server may rely on .htaccess files being parsed. There are quite a few applications whose security heavily relies on
.htaccess files being parsed properly, for example because it denies access to files containing passwords, uploaded PHP files, etc (relying on .htaccess files being parsed isn't ideal, but it does happen frequently).
Doing it right: Adding additional .htaccess file names
If you want to rename your .htaccess file, you have to do two things:
Add the new name to
AccessFileName (do not remove the default .htaccess name):
AccessFileName .htaccess htaccess
And add a deny rule for it:
Require all denied
[it isn't quite clear to me if you want to rename your htaccess file permanently or just temporarily while editing it, but the dangers I described above apply in either case, as does the solution proposed]