What does the WordPress .htaccess file do?
.htaccess is a per-directory configuration file read by Apache and LiteSpeed on every request. WordPress uses it for one essential job: the rewrite block between # BEGIN WordPress and # END WordPress sends every URL that is not a real file or folder to index.php, which is what makes pretty permalinks work.
The same file is also the most practical place to add server-level rules on shared hosting: redirect HTTP to HTTPS, pick one canonical host (www or non-www), deny access to wp-config.php, stop directory listings, set long browser-cache lifetimes for static assets and enable gzip compression. These rules run before PHP starts, so they are faster than doing the same thing in a plugin.
WordPress rewrites only the lines between its own markers when you save Settings → Permalinks (via insert_with_markers()). Anything you put outside those markers survives. This generator therefore places all custom rules in clearly commented sections above the WordPress block, so redirects and access rules are evaluated before the catch-all rewrite to index.php.
How to use the WordPress .htaccess Generator
- Pick your installation type — single site, multisite with subdirectories or multisite with subdomains — and the WordPress folder if it is not the web root.
- Choose redirects (HTTPS, www or non-www) and the security, header, caching and compression rules you want. Start from the Recommended, Minimal or Hardened preset.
- Download a backup of your current
.htaccessvia FTP or your host’s file manager. - Copy or download the generated file and upload it to the folder that contains
wp-config.php. Optionally upload the second file towp-content/uploads/. - Load the home page, a post,
/wp-admin/and an image. If you see a 500 error, restore the backup and remove the last block you added.
Example
The official single-site block that WordPress writes when pretty permalinks are enabled:
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPressGotchas worth knowing
- Nginx ignores .htaccess. On Nginx hosts the equivalent rules go into the server block — the Redirect Generator outputs Nginx syntax for redirects.
- One hop, not two. When you force HTTPS and a canonical host together, the host rule redirects straight to
https://, sohttp://example.comreacheshttps://www.example.comin a single 301. - Behind a CDN or proxy,
%{HTTPS}can beoffeven though visitors use HTTPS. TheX-Forwarded-Protocondition prevents the classic redirect loop with Cloudflare Flexible SSL and load balancers. - php_value only works with mod_php. On PHP-FPM it causes a 500 error unless wrapped in
<IfModule>— which the generator does. Use.user.inior your host’s PHP settings instead. - HSTS is sticky. Browsers cache it for the whole
max-age; test with a short value before committing to a year or preloading. - Blocking
xmlrpc.phpstops brute-force and pingback abuse but also breaks Jetpack and the official mobile apps.
Disabling PHP in the uploads folder
A common post-exploitation step is uploading a PHP web shell through a vulnerable form or plugin into wp-content/uploads. Media files never need to execute, so a small .htaccess in that folder denying .php, .phtml and .phar files neutralises the attack without affecting images or PDFs.
Frequently Asked Questions
Where is the .htaccess file in WordPress?
In the folder that contains wp-config.php and wp-admin/, usually public_html or www. It starts with a dot, so enable “show hidden files” in your FTP client or file manager.
Will WordPress overwrite my custom rules?
No, as long as they are outside the # BEGIN WordPress / # END WordPress markers. WordPress only replaces the lines between its markers when permalinks are saved. Security plugins use their own markers in the same way.
Why do my custom rules go above the WordPress block?
The WordPress block ends with a catch-all RewriteRule . /index.php [L]. Rewrite-based redirects placed after it may never run, so HTTPS, host and blocking rules belong first.
What is the default .htaccess for WordPress Multisite?
Multisite uses a different block that maps wp-admin, wp-content and wp-includes for every site. Choose “Multisite — subdirectories” or “Multisite — subdomains” above; the rules match the ones WordPress shows under Tools → Network Setup.
My site shows “500 Internal Server Error” after uploading. What now?
Restore your backup immediately, then add the sections back one at a time. The usual culprits are php_value on PHP-FPM, a module that is not installed, or Options being disallowed by the host’s AllowOverride setting.
Can I add redirects for old URLs here?
Yes — paste them into Extra rules, or use the WordPress Redirect Generator to convert a list of old and new URLs into validated Redirect and RewriteRule lines. For crawl rules see the robots.txt Generator.