Apache looks for it in each directory of the request path, as long as AllowOverride permits. It is used for redirects, access rules and, with mod_php, php_value and php_flag lines. nginx does not read it, and under PHP-FPM those PHP lines do not apply. LiteSpeed reads php_flag from .htaccess.
Two limits matter for security. PHP treats php_value and php_flag in .htaccess as per-request settings, and a warning or deprecation notice from one of them can trigger CVE-2026-109619. And the admin forms, php_admin_flag and php_admin_value, cannot be used in .htaccess at all, so a site owner can never lock a value there.
In October 2026, Mattias Geniar tested an Apache rule that denies multipart requests, written with an If block on the Content-Type header, and found it works in .htaccess on shared hosting if AllowOverride permits: a GET returned 200 and a multipart POST returned 403. Some guides also suggested php_flag session.upload_progress.enabled off in .htaccess for mod_php, while PHP advises moving per-request settings into php.ini or the pool.
Find the PHP lines in your .htaccess files, for example with find /home -type f -name .htaccess and grep for php_value and php_flag, which is the check that cPanel documents. Move them to php.ini or the pool, and remove any that are invalid or deprecated.