WordPress basics: The Htaccess file

How the Htaccess file works with WordPress

Whether or not you choose to manually edit the .htaccess file, it’s still being worked on by WordPress. WordPress adds rules to .htaccess, as do some WordPress plug-ins. When you change the permalink structure of a WordPress site, rules are written to the .htaccess file so that Apache knows about the changes. Security plug-ins often use .htaccess to block IP addresses or limit access to the site.

If you aren’t familiar with .htaccess or editing configuration files on the htaccess command line, you may prefer to find a plug-in that does what you need before attempting to manually edit .htaccess. These plug-ins are written by developers and extensively tested. 

But if you feel confident enough and have backed up your site, you can still gain quite a few benefits from changing your .htaccess file. From redirects to basic .htaccess security adjustments, let’s take a look at a few short and useful rules you can add on your own.

Create 301 redirects

A 301 redirect is used when a page is permanently moved to a new location. It lets browsers and search engines know that the page is located at a different URL. To redirect a page in your .htaccess file, add the following rule:

• Redirect 301 /old-url/ http://www.example.com/newurl

Block access to sensitive files

Many files in the WordPress directory shouldn’t be readable by the whole internet – the wp-php.config file is a good example. With the following rules, you can block access to files that should not be accessible to all browsers.

• Order deny,allow
• Deny from all

Keeping your sensitive files private with this basic .htaccess adjustment is a smart move, even for new site owners.

Prevent specific IP addresses from loading the site

The .htaccess file can also be used to deny access to requests from particular IPs.

This can be useful for blocking a small number of IP addresses by adding the rules below. 

However, if you’re having problems with brute force attacks against your WordPress site, a plug-in like SiteGuard WP is a more efficient solution.

• order allow, deny
• deny from 203.0.113.0
• allow from all

Make sure to replace the IP address in the above with the address that you would like to block.

Stop directory browsing

Directory browsing, which is permitted by default, allows bad actors to see the files in your WordPress site’s directory – information that might be useful to them.

• Options -Indexes

The above command will prevent directory browsing.

We’ve covered only a few of the many configuration options that can be used to control Apache. For a full explanation, take a look at .htaccess Guide.