Useful .htaccess Rules for WordPress

The .htaccess file is a per-directory Apache config file, and on a WordPress site it controls pretty permalinks, redirects, file protection, and caching. Here are the most useful .htaccess rules for WordPress, what each one does, and how to add them safely. Two warnings before you touch anything: back up the file first, and this is Apache-only. If your host runs Nginx, none of this applies and you configure those behaviors in the server block instead.

What .htaccess is and the WordPress block

Apache reads .htaccess at request time and applies its rules to the folder it sits in and everything below. WordPress lives at your site root, so its .htaccess sits there too.

WordPress manages its own rewrite rules inside a marked section:

# BEGIN WordPress
# ... rules WordPress maintains ...
# END WordPress

Do not edit anything between the # BEGIN WordPress and # END WordPress markers. WordPress rewrites that block automatically, and your changes will be wiped. Add all of your custom rules above the # BEGIN WordPress line.

Force HTTPS and pick www or non-www

Send every visitor to the secure, canonical version of your domain. Force HTTPS:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

Force non-www to www (or flip the logic for the reverse):

RewriteCond %{HTTP_HOST} ^example\.com [NC]
RewriteRule ^(.*)$ https://www.example.com/$1 [R=301,L]

Pick one direction for www and stick with it. The R=301 flag tells browsers and search engines the move is permanent.

Redirect old URLs with 301s

When you change a permalink or retire a page, point the old address at the new one so links and rankings carry over:

Redirect 301 /old-page/ https://www.example.com/new-page/

A 301 is a permanent redirect, which is what you want for moved content.

Protect sensitive files

Block direct access to files that should never be served. Protect wp-config.php and the .htaccess file itself:

<Files wp-config.php>
  Require all denied
</Files>

<Files .htaccess>
  Require all denied
</Files>

This keeps your database credentials and config rules out of reach if directory listing or a misconfiguration ever exposes them.

Add browser caching and compression

Tell browsers to cache static assets and compress text responses so pages load faster:

<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType image/png "access plus 1 year"
  ExpiresByType text/css "access plus 1 month"
</IfModule>

<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/css application/javascript
</IfModule>

These only run if the matching Apache modules are enabled, so they fail safely if a module is missing.

Build it without hand-editing

If you would rather not write rules by hand, the .htaccess Builder generates them for you:

1. Open the .htaccess Builder.
2. Toggle the rules you want, such as force HTTPS, www handling, file protection, and caching.
3. Add any 301 redirects with your old and new paths.
4. Copy the output and paste it above the # BEGIN WordPress block.
5. Save, then load your site in a private window to confirm nothing broke.

The builder runs entirely in your browser, so nothing you type is sent anywhere.

Related tools

• Browser Caching .htaccess Generator - fine-tune cache lifetimes per file type.
• Gzip .htaccess Generator - generate compression rules on their own.
• Security Headers Generator - add headers like HSTS and X-Frame-Options.

Back up the file, add your rules above the WordPress block, and save a faster, safer site in minutes.