WordPress .htaccess

The standard Apache rewrite block, plus optional hardening rules.

Installation type

WordPress path (RewriteBase)

Optional hardening

Protect wp-config.phpRefuses direct HTTP requests for the credentials file. Disable directory browsingStops Apache listing folders that have no index file. Protect .htaccess and .htpasswdApache 2.4 already does this by default. Harmless to repeat. Block xmlrpc.phpRemoves a common brute-force target. Breaks Jetpack, pingbacks, and the mobile apps. Block PHP in uploadsWritten to a second file below, not to the root .htaccess. Redirect HTTP to HTTPSLeave off behind a proxy or load balancer that terminates TLS, or requests will loop.

.htaccess — WordPress root

wp-content/uploads/.htaccess — separate file

WordPress rewrites everything between # BEGIN WordPress and # END WordPress, so hardening rules are placed above that block. Back up the current file first. On nginx, LiteSpeed without .htaccess support, or IIS, these rules are ignored — the equivalents belong in the server configuration.