TOOL · FREE · RUNS IN YOUR BROWSERallwpcare.com/tools/wordpress-htaccess-generator/
Free tool

WordPress .htaccess generator

Pick the extras you want and get a ready .htaccess file for Apache. It always starts with the exact WordPress rules and adds only what you tick.

This works on Apache (and LiteSpeed in Apache mode). Nginx ignores .htaccess. Everything runs in your browser. Nothing is sent anywhere.

1. Your kind of site
2. Extras (all off to start)
3. Use https only

Only turn these on after your site already loads with https:// and shows no warning.

Your file

Save as .htaccess in the main folder of your site (next to wp-config.php).

.htaccess
# Made with the AllWPCare .htaccess generator.
# Keep a copy of your old .htaccess. If the site shows a 500 error, rename this file to .htaccess-off.

# BEGIN WordPress
# The directives (lines) between "BEGIN WordPress" and "END WordPress" are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

Before you replace anything

  1. Download your current .htaccess and keep it. That is your undo.
  2. Replace the file, then open your home page and your login page.
  3. If you see a 500 error, rename the new file to .htaccess-off or put your old one back, then reload.

How it works

The file has your https rules first, then the WordPress block, then the hardening rules.

What each part does

  • The WordPress block sends every address that is not a real file or folder to index.php. That makes links like /about/ work. It is the text WordPress writes when you save Settings → Permalinks.
  • Rules you tick that need an Apache module are wrapped in a check, so a server without it skips them.
  • The uploads file is a second file for wp-content/uploads.

What it does not do

  • It does not read or change your site. You copy the result yourself.
  • It does not accept your own rules. Free text in a rewrite rule often causes redirect loops.
  • It does not write AllowOverride or Options None. They cause 500 errors here.
  • It does not cover WordPress in a sub-folder or old networks that use ms-files.php. Keep your file in those cases.

How it was checked

We tested each rule on a fresh WordPress 7.1 site on Apache 2.4 with curl. /xmlrpc.php, /wp-config.php and /wp-content/debug.log return 403. /, /wp-login.php, /wp-json/ and the admin AJAX address work as before. We also tested a network in both folder and subdomain layouts. A strict host can still return a 500 error, so the undo steps sit next to the result. See 500 Internal Server Error.

FAQ

Where do I put the .htaccess file?

In the folder that holds wp-config.php and wp-content, often called public_html or www. Use your host's File Manager or FTP. Turn on "show hidden files" to see an existing one. The uploads file goes inside wp-content/uploads.

Will WordPress overwrite my changes?

Only the part between # BEGIN WordPress and # END WordPress. We saved Settings → Permalinks twice on a test site with the extras ticked, and the lines above and below stayed the same. That is why redirects go above the block and hardening rules below it. On a network, WordPress leaves the file alone.

My site shows a 500 error after I uploaded the file. What now?

Rename the new file to .htaccess-off, or put your old copy back, and reload. The site comes back. Your host probably does not allow one of the lines. On a test server that only allowed FileInfo, AuthConfig and Limit, Options -Indexes alone caused a 500. Generate again with fewer extras, and ask your host which AllowOverride settings they allow.

Does this work on nginx, or on my managed host?

It works on Apache, and on LiteSpeed in Apache mode. Nginx ignores .htaccess, so the file does nothing there. Many managed hosts use nginx or have their own settings page for these options. If you are not sure, ask your host.

Why are there no caching or Gzip rules?

Your host or cache plugin usually does this already, and two sets of rules can fight each other. We left them out because we could not show they are safe on every site.

Is a site with these options "secure"?

No. No file makes a site secure. Each option says what it does not stop. For the bigger picture, see the hardening guide below.