The WordPress .htaccess File:Default Rules and Safe Edits

In WordPress, the .htaccess file is a configuration file in the site's root folder that Apache and LiteSpeed web servers read on every request. WordPress uses it mainly to make pretty permalinks work: it sends requests for addresses like /about-us/ to index.php, where WordPress decides which page to show. Plugins and hosts also add rules for caching, redirects, HTTPS and security.

Because a single typo in .htaccess can take the whole site offline with a 500 error, it is worth understanding what is in it before changing it.

Where to find it

.htaccess lives in the same folder as wp-config.php, usually public_html. Its name starts with a dot, so it is hidden by default:

• in cPanel File Manager, open Settings and tick Show Hidden Files (dotfiles);
• in an FTP client, enable showing hidden files.

.htaccess is only used by Apache-compatible servers (Apache and LiteSpeed). Nginx ignores it; on Nginx, equivalent rules go in the server configuration.

The default WordPress rules

For a standard single-site installation, WordPress writes this block:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

In plain terms: if the requested path is not a real file or folder, hand the request to index.php. The HTTP_AUTHORIZATION line passes authorisation headers through to PHP, which some APIs need.

Do not edit between # BEGIN WordPress and # END WordPress. WordPress rewrites that section when permalinks are saved, so your changes there would be lost. Put custom rules above or below it.

How to regenerate .htaccess

If the file is missing or broken:

1. Go to Settings → Permalinks in the dashboard.
2. Click Save Changes without changing anything.

WordPress rewrites its block if the file is writable. If it is not, WordPress shows the rules so you can paste them in manually.

Fixing a 500 error caused by .htaccess

1. Rename .htaccess to .htaccess.bak.
2. Load the site. If it works (permalinks may 404 for now), the file was the problem.
3. Regenerate the default rules from Settings → Permalinks.
4. Add your custom rules back one at a time, testing after each.

See common hosting errors: 500, 503, 508 and 403.

Common safe additions

Place these outside the WordPress block, and test after each change.

Redirect HTTP to HTTPS

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Behind a CDN or proxy, HTTPS detection may need a different condition; see how to force HTTPS and fix mixed content.

Block access to sensitive files

<Files wp-config.php>
Require all denied
</Files>

Block XML-RPC if you do not use it

<Files xmlrpc.php>
Require all denied
</Files>

Only do this if no app, plugin or service you rely on uses XML-RPC.

Single-page redirects

Redirect 301 /old-page/ https://example.com/new-page/

For many redirects, a redirect plugin is easier to manage than a long .htaccess file.

What not to put in .htaccess

• Large lists of IP bans copied from the internet; they slow every request and go stale.
• Rules you do not understand from random snippets.
• Duplicate caching or compression rules when your server or cache plugin already handles them.

Stop PHP running in the uploads folder

Attackers who manage to upload a PHP file usually place it in wp-content/uploads. Media folders never need to run PHP, so you can block it with a separate .htaccess file inside wp-content/uploads:

<FilesMatch "\.(php|phtml|php[0-9])$">
  Require all denied
</FilesMatch>

Test afterwards that images still load and that uploading media works. Some plugins store PHP files in their own upload subfolders (rare, but possible); if one breaks, add a narrow exception for that plugin's folder.

Order and conflicts

Apache reads .htaccess rules from top to bottom, and the first matching rewrite with an [L] flag usually ends processing for that pass. Practical consequences:

• put redirects (HTTPS, www, old URLs) above the WordPress block, so they run before WordPress handles the request;
• keep plugin-managed blocks (caching, security) where the plugin puts them;
• when two plugins write rules for the same purpose (two caching plugins, two security plugins), conflicts are likely: keep only one.

Always keep a copy of the last working version before editing, so you can restore it in seconds.

LiteSpeed-specific notes

LiteSpeed reads .htaccess like Apache. The LiteSpeed Cache plugin adds its own # BEGIN LSCACHE block; leave it to the plugin. See LiteSpeed Web Server explained.

Frequently Asked Questions

Why does my WordPress site have no .htaccess file?

It may use plain permalinks, run on Nginx, or WordPress could not write the file. Saving permalinks creates it on Apache and LiteSpeed if the folder is writable.

Can .htaccess files exist in subfolders?

Yes. Rules in a subfolder's .htaccess apply to that folder, which is useful, for example, to block PHP execution in wp-content/uploads.

Does .htaccess affect performance?

Slightly, because the server reads it on each request. A short, tidy file has negligible impact; very long files can add overhead.

Related reading

This is part of the WordPress cluster that starts at WordPress hosting: what it is and how to choose. For security-related rules, see the WordPress security checklist, and compare ServerNeed WordPress hosting.

Sources

• WordPress Developer Resources: htaccess
• Apache HTTP Server: .htaccess files