diff --git a/astro.config.mjs b/astro.config.mjs
index 97090df..0c26271 100644
--- a/astro.config.mjs
+++ b/astro.config.mjs
@@ -7,6 +7,18 @@ import { fileURLToPath } from 'node:url';
 // https://astro.build/config
 export default defineConfig({
   site: 'https://kb.anhonesthost.com',
+  // Send section-only URLs to the first article in that section. Without these,
+  // hitting e.g. /whp/admin/ would render the Apache directory listing because
+  // there is no index.html in that folder.
+  redirects: {
+    '/whp/': '/whp/getting-started/welcome/',
+    '/whp/getting-started/': '/whp/getting-started/welcome/',
+    '/whp/how-to/': '/whp/how-to/add-a-domain/',
+    '/whp/site-builder/': '/whp/site-builder/overview/',
+    '/whp/reference/': '/whp/reference/service-hostnames/',
+    '/whp/add-ons/': '/whp/add-ons/overview/',
+    '/whp/admin/': '/whp/admin/overview/',
+  },
   vite: {
     resolve: {
       alias: {
diff --git a/public/.htaccess b/public/.htaccess
new file mode 100644
index 0000000..0753aab
--- /dev/null
+++ b/public/.htaccess
@@ -0,0 +1,15 @@
+# Static-HTML site hardening for kb.anhonesthost.com.
+# Lands in dist/ at build time and is uploaded with the rest of the site.
+
+# Never expose a directory listing to visitors.
+Options -Indexes
+
+# Astro emits both /path/ (with index.html) and /path.html for every route.
+# Default to the trailing-slash form; Apache MultiViews can sometimes serve
+# /path.html for /path/, which Pagefind doesn't index — disable it.
+Options -MultiViews
+
+# Send anything that doesn't resolve to a file to /404.html.
+# Starlight builds a real 404 page; this just makes Apache serve it.
+ErrorDocument 404 /404.html
+ErrorDocument 403 /404.html
diff --git a/src/content/docs/404.md b/src/content/docs/404.md
new file mode 100644
index 0000000..415d861
--- /dev/null
+++ b/src/content/docs/404.md
@@ -0,0 +1,17 @@
+---
+title: Page not found
+description: That URL doesn't exist on our knowledge base.
+template: splash
+editUrl: false
+hero:
+  title: '404'
+  tagline: That URL doesn't exist on our knowledge base.
+  actions:
+    - text: Go to the knowledge base home
+      link: /
+      icon: right-arrow
+      variant: primary
+    - text: WHP getting started
+      link: /whp/getting-started/welcome/
+      variant: secondary
+---