Create and edit WordPress .htaccess files

When it comes to fine-tuning your WordPress site’s performance, security, and functionality, the .htaccess file often plays an unsung hero. Short for “hypertext access,” this tiny yet powerful file holds the keys to some of the most critical aspects of your website, from URL management to ironclad security configurations.

But here’s the catch: while the .htaccess file is incredibly powerful, it’s equally sensitive. One misplaced character can bring your site to a screeching halt. That’s why understanding how it works – and how to create, edit, and troubleshoot it – can make a world of difference for WordPress site owners.

Get ready to unlock the full potential of your WordPress .htaccess file with this guide!

What is the WordPress .htaccess file and why is it important?

The .htaccess file is a configuration file used by web servers running Apache. Think of it as a command center for managing critical functions like redirects, security, and URL structures. It gives you the ability to:

• Customize your site’s functionality without modifying core WordPress files.
• Enhance security by blocking unauthorized access and preventing common attacks.
• Manage URLs for better user experience and SEO.

By default, WordPress generates a basic .htaccess file to support permalinks. However, the true power of this file lies in its flexibility. With a few tweaks, you can take your site’s performance, security, and functionality to the next level.

Whether you’re securing sensitive directories, enforcing HTTPS, or fixing pesky errors, mastering the .htaccess file can save you time, frustration, and potentially thousands of dollars in lost traffic or compromised data.

Where is the .htaccess file located in WordPress?

The .htaccess file resides in the root directory of your WordPress installation. This is the same directory where core files like wp-config.php and folders like wp-content and wp-admin are located. 

To access the .htaccess file, you’ll need to use one of the following methods:

• Log in to your hosting dashboard (like cPanel), navigate to the root directory, and enable the option to show hidden files.
• Use an SFTP client like FileZilla or Cyberduck to connect to your server and locate the file. If you’re comfortable with command-line tools, SSH can also be used to find and edit the file.

Sometimes, the .htaccess file might not be visible or even exist. Don’t worry – it’s easy to create one. Here’s how:

• Log into your WordPress admin dashboard.
• Navigate to Settings > Permalinks and click Save Changes.
• This action prompts WordPress to generate a new default .htaccess file automatically.
• If this doesn’t work, create a blank file named .htaccess in the root directory and paste in the default WordPress .htaccess structure (covered in the next section).

⭐ Pro tip: Before making any changes to the .htaccess file, back up your site. Even a small mistake can cause major issues like server errors or site downtime.

Understanding the default .htaccess structure in WordPress

Before we jump into the structure of the file itself, let’s clarify one of the key components you’ll encounter: regular expressions (regex). These patterns are used to match specific sequences of characters and play a crucial role in many .htaccess rules, such as redirects and URL rewrites. 

For a deeper understanding, check out this comprehensive guide: “What Are Regular Expressions?”.

Now, let’s take a look at the default .htaccess code generated by WordPress:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

Here’s what this means:

• # BEGIN WordPress and # END WordPress indicate the portion of the file managed by WordPress. Avoid editing within these lines unless absolutely necessary.
• <IfModule mod_rewrite.c> ensures the code runs only if the Apache mod_rewrite module is enabled.
• RewriteEngine On activates the rewrite engine, allowing custom URL rewrites.
• RewriteBase / defines the base directory for your site, usually the root (/).
• RewriteRule ^index\.php$ – [L] ensures the index.php file isn’t rewritten.
• RewriteCond %{REQUEST_FILENAME} !-f and !–d check if the requested file or directory doesn’t exist.
• RewriteRule . /index.php [L] redirects requests for non-existent files or directories to index.php, enabling WordPress to process them.

While WordPress generates this file automatically, you can enhance it for additional functionality by:

• Adding custom rewrite rules.
• Securing your site with access restrictions.
• Optimizing for better performance.

Basic configuration of the WordPress .htaccess file

The default .htaccess file in WordPress is already equipped to handle basic permalink functionality. But with a few simple tweaks, you can tailor it to better suit your site’s needs.

Enabling pretty permalinks

WordPress’s permalinks transform clunky URLs like example.com/?p=123 into clean, user-friendly URLs like example.com/sample-post. The .htaccess file makes this magic happen.

To enable permalinks:

• Go to Settings > Permalinks in your WordPress dashboard.
• Choose your desired structure (e.g., “Post name”).
• Save your changes.

WordPress will update or create the necessary .htaccess file to reflect this change.

Improving site performance with browser caching

Browser caching is a powerful way to enhance your site’s loading speed by storing static assets like images, CSS, and JavaScript on users’ devices for a specified period. By configuring your .htaccess file for caching, you can reduce server load and improve page load times for returning visitors.

Add the following snippet to your .htaccess file:

<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/jpg "access 1 year"
    ExpiresByType image/jpeg "access 1 year"
    ExpiresByType image/gif "access 1 year"
    ExpiresByType image/png "access 1 year"
    ExpiresByType text/css "access 1 month"
    ExpiresByType text/javascript "access 1 month"
    ExpiresByType application/javascript "access 1 month"
    ExpiresByType application/pdf "access 1 month"
    ExpiresByType application/x-shockwave-flash "access 1 month"
    ExpiresDefault "access 2 days"
</IfModule>

This snippet tells browsers to cache certain file types for a specified period, reducing server load and speeding up repeat visits.

Restricting access to sensitive files

Your WordPress site contains files you don’t want visitors or bots poking around in. Use the .htaccess file to block access to these files:

<Files wp-config.php>
    Order Allow,Deny
    Deny from all
</Files>

This snippet ensures no one can access your wp-config.php file directly, bolstering your site’s security.

Redirecting visitors to a maintenance page

Need to perform updates? Use your .htaccess file to redirect all visitors to a maintenance page temporarily:

RewriteEngine On
RewriteCond %{REQUEST_URI} !/maintenance.html$
RewriteCond %{REMOTE_ADDR} !^123\.45\.67\.89$
RewriteRule ^(.*)$ /maintenance.html [R=302,L]

Replace 123.45.67.89 with your IP address so you can still access the site during maintenance.

⭐ Pro tip: After modifying your .htaccess file, test your site thoroughly to ensure everything works as expected. A single error in the file can cause your site to crash or display errors.

Advanced security configurations with .htaccess

Restrict access to wp-admin

Your WordPress admin area is a prime target for attackers. You can limit access to this sensitive area by IP address:

<Files wp-config.php>
    Require all denied
</Files>

Replace 123.45.67.89 with your IPv4 or IPv6 address. If you have multiple authorized users, you can list additional IPs by adding Allow from lines.

Block unwanted IP addresses

Block IP addresses that have been attempting brute force attacks or exhibiting suspicious activity:

<Limit GET POST>
    Require all granted
    Require not ip 192.168.1.1
    Require not ip 203.0.113.0
</Limit>

Simply replace the listed IPs with the ones you want to block.

Password-protect important directories

Add an extra layer of security to sensitive directories like wp-admin by requiring a password:

1. Generate a .htpasswd file using a password generator tool.
2. Place the .htpasswd file outside your web root for added security.
3. Add this code to your .htaccess file within the wp-admin directory:

AuthType Basic
AuthName "Restricted Area"
AuthUserFile /path/to/.htpasswd
Require valid-user

Replace /path/to/.htpasswd with the actual path to your .htpasswd file.

Restrict file access

Prevent access to critical files such as xmlrpc.php, which is commonly exploited by attackers:

<Files xmlrpc.php>
    Require all denied
</Files>

This ensures the file cannot be accessed directly.

Prevent directory browsing

Directory browsing allows visitors to see a list of files in your directories, which can expose sensitive information. Disable it with this simple line:

Options -Indexes

Prevent hotlinking

Stop other websites from embedding your images and stealing your bandwidth:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^https://(www\.)?yourdomain\.com/ [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ - [F]

Replace yourdomain.com with your actual domain name.

Block common exploits

Protect your site from known attack vectors by blocking suspicious requests:

<IfModule mod_rewrite.c>
    RewriteCond %{QUERY_STRING} (\?|%3F).*benchmark.*(\?|%3F) [NC,OR]
    RewriteCond %{QUERY_STRING} (\?|%3F).*base64_encode.*(\?|%3F) [NC,OR]
    RewriteCond %{QUERY_STRING} (\?|%3F).*union.*(\?|%3F) [NC]
    RewriteRule .* - [F]
</IfModule>

This rule blocks requests containing common malicious patterns.

Disable PHP execution in specific directories

To prevent malicious PHP scripts from running in directories like uploads, create a new .htaccess file in the wp-content/uploads directory and add the following code:

<FilesMatch "\.php$">
    Require all denied
</FilesMatch>

Using .htaccess for URL management in WordPress

Setting up rewrite rules

Rewrite rules allow you to create clean, SEO-friendly URLs or redirect users dynamically. Here’s a basic example:

RewriteEngine On
RewriteRule ^old-page$ /new-page [R=301,L]

Enforcing HTTPS

With SSL certificates becoming a standard, enforcing HTTPS is essential for securing your site and improving trust with visitors. Add this snippet to your .htaccess file:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This ensures all visitors are redirected to the HTTPS version of your site automatically.

Redirecting WWW to non-WWW (or vice versa)

Decide whether you want your site to use www or not. Consistency is key for SEO. To redirect WWW to non-WWW, add the following lines:

RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ https://%1/$1 [L,R=301]

If you’re redirecting from non-WWW to WWW, then add these lines instead:

RewriteEngine On
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}/$1 [L,R=301]

Fixing trailing slash issues

Consistency in URL structure matters. Use this rule to add a trailing slash to URLs if missing:

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*[^/])$ /$1/ [L,R=301]

Managing 301 redirects for SEO

When you delete or move a page, set up 301 redirects to guide users and search engines to the new location:

Redirect 301 /old-page /new-page

You can list as many redirects as needed.

Blocking query string exploits

Protect your site from exploitative query strings by blocking suspicious patterns:

RewriteCond %{QUERY_STRING} (\?|%3F).*union.*(\?|%3F) [NC]
RewriteRule .* - [F]

Redirecting to a custom 404 page

If you want a branded experience for missing pages, redirect to a custom 404 page:

ErrorDocument 404 /custom-404.html

Ensure the file custom-404.html exists in your root directory.

Redirecting users based on country or device

For advanced sites, you can use the .htaccess file to redirect users based on their location or device type. While this requires more configuration, it’s an option to explore for multilingual or mobile-optimized sites.

⭐ Pro tip: Before implementing redirects or rewrites, use tools like Google’s URL Inspection Tool or online redirect testers to ensure your changes are working correctly.

Troubleshooting common .htaccess file issues

500 internal server errors

A malformed .htaccess file is one of the most common culprits of the 500 error. This happens if there’s a syntax error or conflicting rules.

To fix this:

• Back up the existing .htaccess file: Rename the file to .htaccess-backup using an SFTP client or file manager.
• Regenerate the .htaccess file: Log in to your WordPress dashboard, navigate to Settings > Permalinks, and click Save Changes to generate a new default .htaccess file.
• Check your server logs: Review error logs in your hosting control panel for clues.

404 errors despite existing content

If your permalinks aren’t working, it’s likely because the .htaccess file isn’t configured properly.

To fix this: 

• Verify that the .htaccess file exists in the root directory.
• Ensure the default .htaccess structure is present:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

• Save the permalinks again in Settings > Permalinks to refresh the .htaccess file.

.htaccess file missing

The .htaccess file might be missing because it wasn’t created during installation or was accidentally deleted.

To fix this:

• Create a new file named .htaccess in your site’s root directory.
• Add the default WordPress .htaccess structure mentioned above.
• Ensure the file permissions are set to 644 to allow WordPress to write to it.

Redirect loops

Redirect loops occur when conflicting or misconfigured rules in the .htaccess file continuously redirect traffic in a loop.

To fix this:

• Look for duplicate or conflicting rules in the .htaccess file, especially around redirects.
• Disable all custom redirect rules temporarily and test the site.
• Add rules back incrementally to identify the conflicting ones.

Configuration issues after migration

When moving a WordPress site to a new host or domain, the .htaccess file may still reference the old server or paths.

To fix this:

• Update the RewriteBase directive in the .htaccess file to match your new installation path, if necessary.
• Regenerate the .htaccess file by saving the permalinks in Settings > Permalinks.
• Check your wp-config.php file for any hardcoded URLs that need updating.

.htaccess file overwritten by plugins

Certain plugins (e.g., caching or security plugins) can modify your .htaccess file, potentially causing conflicts.

To fix this:

• Review plugin settings for .htaccess-related options and disable them temporarily.
• Restore the .htaccess file from a backup or add the default structure manually.
• Test plugin compatibility with your site.

Permission denied errors

Incorrect file permissions can prevent the web server from reading the .htaccess file.

To fix this:

• Set the .htaccess file permissions to 644 using your SFTP client or hosting control panel.
• Ensure the parent directories have appropriate permissions (usually 755).

Choose Liquid Web for hassle-free WordPress optimization

Managing your WordPress .htaccess file is a rewarding yet intricate task. From securing your admin area to fine-tuning your site’s performance and troubleshooting errors, this small but mighty file holds immense power. However, the margin for error is slim, and a single misstep can lead to downtime, broken links, or worse – security vulnerabilities.

That’s where Liquid Web comes in with managed hosting solutions for WordPress to take the stress out of managing your website’s backend. Our platform can take care of updates, configurations, and optimizations, so you can focus on what matters most – growing your business and delivering value to your audience.

Here’s what you get with Liquid Web:

• Industry-leading WordPress speed and reliability to keep your site running smoothly.
• Proactive monitoring, malware protection, and automatic SSLs to safeguard your data.
• Access to WordPress experts around the clock, ready to assist with any issue, big or small.

Why risk the guesswork when you can partner with a hosting provider that does it all? Get started with Liquid Web’s managed WordPress hosting today and discover how you can achieve peak performance and security for your site!