{"id":179,"date":"2020-09-15T17:42:35","date_gmt":"2020-09-16T00:42:35","guid":{"rendered":"https:\/\/presscargo.local\/?p=179"},"modified":"2021-12-09T15:28:36","modified_gmt":"2021-12-09T23:28:36","slug":"wordpress-htaccess","status":"publish","type":"post","link":"https:\/\/presscargo.io\/articles\/wordpress-htaccess\/","title":{"rendered":"The Ultimate Guide to .htaccess for WordPress"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">What is the .htaccess File?<\/h2>\n\n\n\n<p>The <code>.htaccess<\/code> file is a server configuration file used by the Apache web server for your WordPress installation. If your WordPress site runs on Apache, it will contain a .htaccess file.<\/p>\n\n\n\n<p>The <code>.htaccess<\/code> file functions like a gatekeeper for your web server. In WordPress, it is primarily used to handle permalinks. With some custom configuration it can also block users, block image hotlinking, password protect directories, and handle URL redirects.<\/p>\n\n\n\n<p>When you install WordPress on an Apache server, the <code>.htaccess<\/code> file is installed in your root directory by default. In some instances, the file is not found or it not generated. Here are some common reasons:<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why Can&#8217;t I Find the .htaccess File?<\/h2>\n\n\n\n<p>There are three reasons the <code>.htaccess<\/code> file does not appear in your website&#8217;s root folder:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Your Server is Not Running Apache<\/h3>\n\n\n\n<p>If your server runs on nginx, then it does not use <code>.htaccess<\/code> files. Some hosts that use nginx are:<\/p>\n\n\n\n<ul><li><a href=\"https:\/\/siteground.com\" class=\"rank-math-link\" target=\"_blank\" rel=\"noopener\">SiteGround<\/a><\/li><li><a href=\"https:\/\/ww2.inmotionhosting.com\/\" class=\"rank-math-link\" target=\"_blank\" rel=\"noopener\">InMotion<\/a><\/li><li><a href=\"https:\/\/getflywheel.com\/\" class=\"rank-math-link\" target=\"_blank\" rel=\"noopener\">Flywheel<\/a><\/li><li><a href=\"https:\/\/kinsta.com\/\" class=\"rank-math-link\" target=\"_blank\" rel=\"noopener\">Kinsta<\/a><\/li><\/ul>\n\n\n\n<p>Here is a more comprehensive <a href=\"https:\/\/www.whoishostingthis.com\/compare\/nginx\/\" target=\"_blank\" rel=\"noopener\">list<\/a>. If you are not sure, contact your host&#8217;s support team for clarification.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Your FTP Client is Not Showing Hidden Files<\/h3>\n\n\n\n<p>The <code>.htaccess<\/code> file is a hidden system file. Most FTP clients do not show hidden files by default, so you may need to enable the &#8220;show hidden files&#8221; option in your FTP client.<\/p>\n\n\n\n<p>In <a href=\"https:\/\/filezilla-project.org\/\" class=\"rank-math-link\" target=\"_blank\" rel=\"noopener\">FileZilla<\/a>, you can enable the option under &#8220;Server \u00bb Force showing hidden files.<\/p>\n\n\n\n<p>In <a href=\"https:\/\/panic.com\/transmit\/\" class=\"rank-math-link\" target=\"_blank\" rel=\"noopener\">Transmit<\/a>, the option is found under &#8220;View \u00bb Show Invisible Files.&#8221;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. The .htaccess File Doesn&#8217;t Exist<\/h3>\n\n\n\n<p>There are other times when the <code>.htaccess<\/code> file simply does not exist, because your WordPress site has not generated it yet.<\/p>\n\n\n\n<p>The easiest way to generate a <code>.htaccess<\/code> file is to log in to your WordPress dashboard and go to Settings \u00bb Permalinks. When you click on the &#8220;Save Changes&#8221; button, WordPress will attempt to generate the file.<\/p>\n\n\n\n<p>If you get an error while saving the Permalinks settings, it may due to permissions issues on your server. In this case, create a new file in a text editor and name it <code>htaccess.txt<\/code> so it get hidden. Copy and paste this code into the file:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># BEGIN WordPress\nRewriteEngine On\nRewriteBase \/\nRewriteRule ^index\\\\.php$ - &#091;L] RewriteCond %{REQUEST_FILENAME} !-f\nRewriteCond %{REQUEST_FILENAME} !-d\nRewriteRule . \/index.php &#091;L]\n# END WordPress<\/code><\/pre>\n\n\n\n<p>Upload the file to your root directory using your FTP client. Rename the file to <code>.htaccess<\/code>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Editing Your .htaccess file<\/h2>\n\n\n\n<p>You can edit your .htaccess file in a number of ways. In cPanel, you can go to File Manager and select the file for editing.<\/p>\n\n\n\n<p>Most FTP clients also allow you to edit the file directly. In FileZilla, right-click the file and choose &#8220;View\/Edit&#8221; to edit the file.<\/p>\n\n\n\n<p>There are two things to note before editing your file.<\/p>\n\n\n\n<p>First, <strong>be sure to backup your current file<\/strong>! It&#8217;s as simple as copy and pasting the contents to another text file.<\/p>\n\n\n\n<p>Second, the code block that begins with <code># BEGIN WordPress<\/code> and ends with <code># END WordPress<\/code> are automatically generated. Do not add anything between those lines, as they will get overwritten when WordPress makes its changes. To ensure that your edits are preserved, add them before or after the code block.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Customizing Your .htaccess file<\/h2>\n\n\n\n<p>Now that you have your <code>.htaccess<\/code> file, it&#8217;s time for the fun stuff. Here are some of the things you can do with <code>.htaccess<\/code>:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Redirect Rules<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Use Production Images in Local<\/h4>\n\n\n\n<p>If you develop WordPress sites locally, you might want to use production images on your local site to save space. In this case, you can use <code>.htaccess<\/code> to redirect requests for files in the upload folder to the production server. Important: do this on your local machine, and not on your production server!<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>RewriteCond %{REQUEST_URI} ^\/wp-content\/uploads\/&#091;^\\\\\/]*\/.*$\nRewriteRule ^(.*)$ &lt;https:\/\/example.com\/$1&gt; &#091;QSA,L]<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Force www URLs<\/h4>\n\n\n\n<p>This will force <code>example.com<\/code> to use <code>www.example.com<\/code><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>RewriteEngine on\nRewriteCond %{HTTP_HOST} ^example.com &#091;NC]\nRewriteRule ^(.*)$ &lt;https:\/\/www.example.com\/$1&gt; &#091;L,R=301,NC]<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Force non-www URLs<\/h4>\n\n\n\n<p>This will force <code>www.example.com<\/code> to use <code>example.com<\/code><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>RewriteEngine on\nRewriteCond %{HTTP_HOST} ^www.example.com &#091;NC]\nRewriteRule ^(.*)$ &lt;https:\/\/example.com\/$1&gt; &#091;L,R=301]<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Force HTTPS<\/h4>\n\n\n\n<p>Force your site to load on https using the following rules.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>RewriteEngine On\nRewriteCond %{HTTP:X-Forwarded-Proto} !https\nRewriteRule ^(.*)$ https:\/\/%{HTTP_HOST}\/$1 &#091;R=301,L]<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Security Rules<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Protect .htaccess<\/h4>\n\n\n\n<p>Since <code>.htaccess<\/code> is your gatekeeper, it&#8217;s a good idea to protect the gatekeeper itself:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;files ~ &quot;^.*\\\\.(&#091;Hh]&#091;Tt]&#091;Aa])&quot;&gt;\norder allow,deny\ndeny from all\nsatisfy all\n&lt;\/files&gt;<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Protect wp-config.php<\/h4>\n\n\n\n<p>Your <code>wp-config.php<\/code> file contains your database name and password. If a hacker can read this file, they can access your entire site. Use the following lines to prevent unauthorized access:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;files wp-config.php&gt;\norder allow,deny\ndeny from all\n&lt;\/files&gt;<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Restrict Access to the Admin<\/h4>\n\n\n\n<p>You can use <code>.htaccess<\/code> to restrict access to the WordPress dashboard. The code below blocks access from all IP addresses except for the ones you specify. For this to work, put a new <code>.htaccess<\/code> file in the <code>wp-admin<\/code> directory.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;Limit GET POST PUT&gt;\norder deny,allow\ndeny from all\nallow from xxx.xxx.xxx.xxx\nallow from xxx.xxx.xxx.xxx\n&lt;\/Limit&gt;<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Prevent Directory Browsing<\/h4>\n\n\n\n<p>It&#8217;s possible to access your site directories via the browser. To prevent potential hackers from taking advantage of that, insert the following lines into your <code>.htaccess<\/code> file.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Options All -Indexes<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Prevent PHP File Execution<\/h4>\n\n\n\n<p>One common hacking tactic is to upload and execute PHP code into the <code>\/wp-content\/uploads<\/code> folder. Create a <code>.htaccess<\/code> file in the <code>\/wp-content\/uploads<\/code> folder and insert the following code to prevent PHP execution.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;Files *.php&gt;\ndeny from all\n&lt;\/Files&gt;<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Prevent Image Hot Linking<\/h4>\n\n\n\n<p><a href=\"https:\/\/themeisle.com\/blog\/prevent-image-hotlinking-in-wordpress\/\" target=\"_blank\" rel=\"noopener\">Image hotlinking<\/a> eats up your bandwidth and can slow down your site. Prevent others from hotlinking to your images<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>RewriteEngine On\nRewriteCond %{HTTP_REFERER} !^$\nRewriteCond %{HTTP_REFERER} !^https:\/\/(www\\\\.)?example.com\/.*$ &#091;NC]\nRewriteRule \\\\.(png|gif|jpg|jpeg)$ &lt;https:\/\/www.example.com\/wp-content\/uploads\/hotlink.gif&gt; &#091;R,L]<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Block IP Addresses<\/h4>\n\n\n\n<p>If you know someone is trying to hack your site from a suspicious IP address, you can use the following code to block them.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;Limit GET POST&gt;\norder allow,deny\ndeny from 123.456.78.9\nallow from all\n&lt;\/Limit&gt;<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p>The .htaccess file is a powerful tool that configures access to your web server. As such, use it carefully and always make sure you have a backup. A lot of the examples presented above can be done using plugins. Most of the time that is a better option.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>What is the .htaccess File? The .htaccess file is a server configuration file used by the Apache web server for your WordPress installation. If your WordPress site runs on Apache, it will contain a .htaccess file. The .htaccess file functions like a gatekeeper for your web server. In WordPress, it is primarily used to handle &#8230; <\/p>\n<p class=\"read-more-container\"><a title=\"The Ultimate Guide to .htaccess for WordPress\" class=\"read-more button\" href=\"https:\/\/presscargo.io\/articles\/wordpress-htaccess\/#more-179\" aria-label=\"More on The Ultimate Guide to .htaccess for WordPress\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":184,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":"","_jetpack_memberships_contains_paid_content":false},"categories":[1],"tags":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/presscargo.io\/wp-content\/uploads\/2020\/09\/wordpress-htaccess.jpg","_links":{"self":[{"href":"https:\/\/presscargo.io\/wp-json\/wp\/v2\/posts\/179"}],"collection":[{"href":"https:\/\/presscargo.io\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/presscargo.io\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/presscargo.io\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/presscargo.io\/wp-json\/wp\/v2\/comments?post=179"}],"version-history":[{"count":1,"href":"https:\/\/presscargo.io\/wp-json\/wp\/v2\/posts\/179\/revisions"}],"predecessor-version":[{"id":234,"href":"https:\/\/presscargo.io\/wp-json\/wp\/v2\/posts\/179\/revisions\/234"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/presscargo.io\/wp-json\/wp\/v2\/media\/184"}],"wp:attachment":[{"href":"https:\/\/presscargo.io\/wp-json\/wp\/v2\/media?parent=179"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/presscargo.io\/wp-json\/wp\/v2\/categories?post=179"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/presscargo.io\/wp-json\/wp\/v2\/tags?post=179"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}