diff --git a/pkg/webserver/openlitespeed/vhost.go b/pkg/webserver/openlitespeed/vhost.go
index 1f20db68d..2d4ad5714 100644
--- a/pkg/webserver/openlitespeed/vhost.go
+++ b/pkg/webserver/openlitespeed/vhost.go
@@ -589,7 +589,6 @@ func (v *baseVhost) buildRootContext(cfg *conf.Config, consumed map[int]bool) {
 	ctx.Add("allowBrowse", "1")
 	rw := ctx.AddBlock("rewrite", "")
 	rw.Add("enable", "1")
-	rw.Add("autoLoadHtaccess", "1")
 	for i, auth := range v.auths {
 		if auth.Path == "/" && !consumed[i] {
 			ctx.Add("realm", v.realmName(i))
@@ -702,6 +701,7 @@ func (v *baseVhost) buildIncludes(cfg *conf.Config) []string {
 func (v *baseVhost) buildRewrite(cfg *conf.Config, fragments []string) {
 	rw := cfg.AddBlock("rewrite", "")
 	rw.Add("enable", "1")
+	rw.Add("autoLoadHtaccess", "1")
 
 	// OLS 核心对 /.well-known/acme-challenge/ 强制跳过 rewrite，无需排除验证路径
 	if !v.Enable() {
diff --git a/pkg/webserver/openlitespeed/vhost_test.go b/pkg/webserver/openlitespeed/vhost_test.go
index c258bf3de..fbdfcf9b3 100644
--- a/pkg/webserver/openlitespeed/vhost_test.go
+++ b/pkg/webserver/openlitespeed/vhost_test.go
@@ -356,3 +356,16 @@ func TestProxyAuthContext(t *testing.T) {
 
 	check.DeepEqual(t, vhost.BasicAuth(), []types.BasicAuth{{Path: "/secret", UserFile: filepath.Join(configDir, "htpasswd_0")}}, cmpopts.EquateEmpty())
 }
+
+// autoLoadHtaccess 只在 vhost 级生效，写进 context 会被 OLS 静默忽略
+func TestHtaccessAtVhostLevel(t *testing.T) {
+	configDir := newConfigDir(t)
+	vhost, err := NewPHPVhost(configDir)
+	must.NoError(t, err)
+	must.NoError(t, vhost.Save())
+
+	cfg, err := Parse(readConf(t, configDir))
+	must.NoError(t, err)
+	check.Equal(t, cfg.GetBlock("rewrite").Value("autoLoadHtaccess"), "1")
+	check.Empty(t, cfg.GetBlock("context", "/").GetBlock("rewrite").Value("autoLoadHtaccess"))
+}