Ultimate WordPress .htaccess Guide

Ultimate WordPress .htaccess Guide: Secure & Redirect Your Site Like a Pro

The .htaccess file is one of the most powerful configuration files on your Apache web server. With just a few lines of code, you can significantly boost your website’s loading speed, fix critical SEO redirection issues, and build a fortress-like security wall against hackers.

In this guide, we will share the ultimate, production-ready .htaccess template optimized specifically for WordPress in 2026.
Why Do You Need a Custom .htaccess File?

By default, WordPress creates a very basic .htaccess file that only handles pretty permalinks. However, leaving it as-is means you are missing out on essential security headers and vulnerability patches.

Our optimized configuration focuses on two main pillars: Flawless SEO Redirects and Advanced Browser-Level Security.

Here is the complete, high-performance code you can safely copy and paste into your root directory:

# ======================================================================
# 1. REDIRECTS (SEO & Clean URL Structure)
# ======================================================================
RewriteEngine On

# Redirect WWW to Non-WWW smoothly
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L]

# Force HTTPS connection
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

# ======================================================================
# 2. ADVANCED HTTP SECURITY HEADERS
# ======================================================================
<IfModule mod_headers.c>
    # Block Cross-Site Scripting (XSS) attacks
    Header set X-XSS-Protection "1; mode=block"
    
    # Prevent Clickjacking attacks (Disallow embedding in iframes)
    Header set X-Frame-Options "SAMEORIGIN"
    
    # Prevent MIME Sniffing vulnerabilities (Stops disguised malware execution)
    Header set X-Content-Type-Options "nosniff"
    
    # Enforce Strict Transport Security (HSTS) for 1 Year
    Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    
    # Protect visitor privacy on outbound links
    Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# ======================================================================
# 3. CORE SYSTEM & FILE PROTECTION
# ======================================================================
# Hide server signature and software versions
ServerSignature Off

# Disable directory browsing (Prevents hackers from viewing your file lists)
Options -Indexes

# Protect wp-config.php (Your database credentials)
<Files wp-config.php>
    Order deny,allow
    Deny from all
</Files>

# Protect the .htaccess file itself from external access
<Files .htaccess>
    Order allow,deny
    Deny from all
</Files>

# Block XML-RPC requests to prevent Brute Force attacks
<Files xmlrpc.php>
    Order deny,allow
    Deny from all
</Files>

# Allow access to the default 403 error page
<Files 403.shtml>
    Order allow,deny
    Allow from all
</Files>

# Restrict direct PHP execution inside the wp-includes folder
<IfModule mod_rewrite.c>
    RewriteRule ^wp-admin/includes/ - [F,L]
    RewriteRule !^wp-includes/ - [S=3]
    RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
    RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
    RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>

# Filter out malicious script injections (XSS Guard)
RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]

Deep Dive: Key Security Features Explained

  1. Dynamic 301 Redirects (Single-Step)

Unlike poorly written rewrite rules that cause “Too Many Redirects” loops, this code forces both HTTPS and Non-WWW in a single, efficient step. This preserves your Google Crawl Budget and ensures search engine bots index your canonical URLs properly.

  1. X-Content-Type-Options: “nosniff”

This header is a lifesaver against dangerous backdoor exploits like the infamous default.php script virus. Hackers often disguise malicious PHP scripts as innocent image files (e.g., default.jpg). The nosniff directive forces the browser to respect the server’s declared MIME type, completely neutralizing disguised scripts before they can execute in the visitor’s browser.

  1. Strict-Transport-Security (HSTS)

HSTS tells modern browsers that your site must only be accessed via HTTPS. It eliminates the vulnerable HTTP-to-HTTPS transition window, protecting your users from Man-in-the-Middle (MitM) and SSL Strip attacks.
How to Safely Implement This Code

Log in to your hosting account via FTP or cPanel File Manager.

Locate the .htaccess file in your WordPress root directory (ensure “Show Hidden Files” is enabled).

Backup your existing file by downloading it to your local computer.

Open the file, remove the default rules, paste the configuration above, and save the changes.

Test your website in an Incognito/Private browser window to ensure everything loads perfectly.

Scroll to Top