The Ultimate .htaccess File for WordPress – Secure, Optimize, and Control Your Site

What Is the .htaccess File in WordPress?

The .htaccess file is a powerful configuration file used by web servers running Apache. It sits in the root directory of your WordPress site and allows you to control key behaviors such as:

• Pretty permalinks
• Security rules
• Compression
• Caching
• Bot protection
• Access control

⚠️ Be cautious: Even one incorrect line in .htaccess can crash your site. Always back it up before making changes.

Default .htaccess Generated by WordPress

When you enable “Pretty Permalinks” in WordPress, it auto-generates the following rules:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPressCode language: HTML, XML (xml)

This helps convert ugly URLs like ?p=123 into clean, readable slugs like /blog/my-post/

Essential Security Rules for WordPress

Disable Directory Browsing

Options -Indexes

Prevents users from seeing a list of files in directories like /wp-content/uploads/.

Block Access to Sensitive Files

<FilesMatch "^(wp-config\.php|\.htaccess|php\.ini)$">
  Order allow,deny
  Deny from all
</FilesMatch>Code language: HTML, XML (xml)

Blocks direct access to important config files that contain sensitive information.

Protect the .htaccess File Itself

<Files .htaccess>
  Order allow,deny
  Deny from all
</Files>Code language: HTML, XML (xml)

Stops attackers from reading or modifying your .htaccess.

Speed Optimization with GZIP and Caching

Enable GZIP Compression

<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/plain text/html text/xml text/css text/javascript application/javascript application/json
</IfModule>Code language: HTML, XML (xml)

Compresses web content before sending it to users’ browsers, reducing file sizes and speeding up loading times.

Enable Browser Caching

<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType image/jpg "access plus 1 year"
  ExpiresByType image/jpeg "access plus 1 year"
  ExpiresByType image/gif "access plus 1 year"
  ExpiresByType image/png "access plus 1 year"
  ExpiresByType text/css "access plus 1 month"
  ExpiresByType application/javascript "access plus 1 month"
</IfModule>Code language: JavaScript (javascript)

Tells browsers to cache static resources like images, CSS, and JS files — saving load time on return visits.

Block Bad Bots and Prevent Hotlinking

Block Bad Crawlers

BrowserMatchNoCase "AhrefsBot" bad_bot
BrowserMatchNoCase "SemrushBot" bad_bot
BrowserMatchNoCase "MJ12bot" bad_bot
Order Allow,Deny
Allow from all
Deny from env=bad_botCode language: JavaScript (javascript)

Use this to block crawlers that consume bandwidth or scrape your content. ⚠️ Do not block Googlebot or Bingbot.

Prevent Image Hotlinking

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.com [NC]
RewriteRule \.(jpg|jpeg|png|gif|webp)$ - [F,NC,L]Code language: JavaScript (javascript)

Prevents other websites from stealing your images and draining your server bandwidth. Replace yourdomain.com with your actual domain.

Advanced .htaccess Tweaks

Disable XML-RPC (optional)

<Files xmlrpc.php>
  Order Deny,Allow
  Deny from all
</Files>Code language: HTML, XML (xml)

xmlrpc.php is often abused in brute-force attacks. Disable it unless you’re using Jetpack or remote publishing.

Restrict Login Access by IP

<Files wp-login.php>
  Order Deny,Allow
  Deny from all
  Allow from 123.123.123.123
</Files>Code language: HTML, XML (xml)

Only allows login from your IP. Great for extra protection on small websites.

Disable PHP Execution in Uploads Folder

<Directory "/wp-content/uploads/">
  <FilesMatch "\.php$">
    Order Deny,Allow
    Deny from all
  </FilesMatch>
</Directory>Code language: HTML, XML (xml)

Prevents attackers from executing PHP files they might upload via insecure plugins or forms.

Full Sample .htaccess Template for WordPress

You can copy, paste, and customize the following as your starting point:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

### ========== SECURITY SETTINGS ==========

# Disable directory browsing
Options -Indexes

# Block access to sensitive files
<FilesMatch "^(wp-config\.php|\.htaccess|php\.ini|\.env|\.git|\.svn|config\.json|setup-config\.php)$">
Order allow,deny
Deny from all
</FilesMatch>

# Block access to backup and source files
<FilesMatch "\.(bak|zip|tar|gz|sql|log|sh)$">
Order allow,deny
Deny from all
</FilesMatch>

# Block access to .htaccess
<Files .htaccess>
Order allow,deny
Deny from all
</Files>

# Block access to XML-RPC (unless needed)
<Files xmlrpc.php>
Order Deny,Allow
Deny from all
</Files>

# Block suspicious request patterns (shell, eval, etc.)
<IfModule mod_rewrite.c>
RewriteCond %{HTTP_USER_AGENT} !(Googlebot|Bingbot|Slurp|DuckDuckBot|facebookexternalhit|Twitterbot) [NC]
RewriteCond %{REQUEST_URI} (eval|base64|webshell|cmd|phpinfo|telescope|actuator|shell) [NC]
RewriteRule .* - [F,L]
</IfModule>

# Allow sitemap and robots.txt for SEO
<FilesMatch "^(robots\.txt|sitemap\.xml)$">
Order allow,deny
Allow from all
</FilesMatch>

# Protect from some bad bots (optional, basic)
SetEnvIfNoCase User-Agent "curl" bad_bot
SetEnvIfNoCase User-Agent "wget" bad_bot
SetEnvIfNoCase User-Agent "python-requests" bad_bot
Order Allow,Deny
Allow from all
Deny from env=bad_bot

### ========== PERFORMANCE SETTINGS ==========

# GZIP compression
<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/html text/plain text/css application/javascript application/json application/xml image/svg+xml
</IfModule>

# Browser caching
<IfModule mod_expires.c>
ExpiresActive On
ExpiresByType image/png "access plus 1 year"
ExpiresByType image/jpeg "access plus 1 year"
ExpiresByType image/gif "access plus 1 year"
ExpiresByType text/css "access plus 1 month"
ExpiresByType application/javascript "access plus 1 month"
ExpiresByType application/font-woff2 "access plus 1 year"
</IfModule>
Code language: PHP (php)

A well-optimized .htaccess file can dramatically improve your WordPress site’s security, performance, and control. Whether you’re a beginner or developer, starting with a clean, reliable .htaccess template is essential.

Frequently Asked Questions (FAQs)