The .htaccess file is a powerful configuration file for Apache web servers. WordPress uses .htaccess for URL rewriting, but it can do much more — improve security, enhance performance, and configure caching. Understanding .htaccess configuration gives you control over your WordPress site at the server level.
This guide covers how to optimize your WordPress .htaccess file for Apache servers.
WordPress Rewrite Rules
WordPress automatically generates rewrite rules in .htaccess when you save permalink settings. These rules direct all requests to index.php unless the requested file or directory exists. Never manually edit the WordPress rewrite block — WordPress regenerates it when you save permalinks. Add your custom rules before the WordPress rewrite block for proper precedence.
The WordPress rewrite rules are between # BEGIN WordPress and # END WordPress markers.
Security Headers
Add security headers to .htaccess to protect your site. X-Frame-Options prevents clickjacking by controlling whether your site can be embedded in iframes. X-Content-Type-Options prevents MIME-type sniffing. Strict-Transport-Security enforces HTTPS connections. Content-Security-Policy controls which resources can be loaded. Referrer-Policy controls how much referrer information is sent.
Test security headers with online tools after adding them.
Performance Rules
Use .htaccess to improve performance. Enable compression with mod_deflate for HTML, CSS, JavaScript, and SVG files. Set browser caching with Expires headers for different file types. Enable Keep-Alive to allow multiple requests over a single connection. These rules reduce page load times without modifying WordPress code.
Test that compression is working after adding rules. Overly aggressive compression can cause issues with some browsers.
Blocking Bad Traffic
Block malicious traffic before it reaches WordPress. Block requests to wp-admin from unauthorized IP addresses. Block requests with suspicious query strings. Block requests to sensitive files like wp-config.php, readme.html, and install.php. Block user agents associated with bad bots. Ban IP addresses that show malicious behavior patterns.
Use RewriteCond and RewriteRule directives to implement blocking rules.
Redirects
Implement redirects in .htaccess for performance — server-level redirects are faster than plugin-based ones. Add HTTP to HTTPS redirect. Add www to non-www redirect (or vice versa). Redirect old URL patterns to new ones. Redirect specific files and directories that have moved. Avoid redirect chains by combining multiple redirects.
Test all redirects after implementation. Misconfigured redirects can create loops that break your site.
Il punto fondamentale
The .htaccess file provides server-level control over your WordPress site. Use it for permalink rewriting, security headers, performance optimization, traffic blocking, and redirects. Never edit the WordPress rewrite rules block directly, and test all changes after implementation. Well-configured .htaccess improves security and performance without modifying WordPress code.
