If I call the .htaccess file in the browser e.g. https://www.mycompany.com/.htaccess, then it is getting downloaded. Is there a way to fix this?
I added this block to my .htaccess file, but it does not help:
<Files "\.htaccess"> Order allow,deny Deny from all </Files>
This is obviously a security hole.