WordPress .htaccess generator
Add a few server-level protections without writing Apache rules yourself. The generator runs in your browser and does not upload anything.
How to use it
WordPress uses .htaccess for permalinks on Apache and LiteSpeed servers. It can also block access to sensitive files before WordPress loads. Nginx does not use this file.
- 1. Choose the protections you need. The defaults are a safe starting point.
- 2. Copy the rules and paste them above
# BEGIN WordPress. Do not replace the WordPress block. - 3. Upload the file, then follow the checks below. Keep a backup in case the server returns a 500 error.
4 protections. Paste above the WordPress block.
Apache 2.4 or LiteSpeed with mod_authz_core. Nginx ignores this file. Backup first. Paste above # BEGIN WordPress and leave that block alone.
Downloads as htaccess.txt. Paste above # BEGIN WordPress. Rename to .htaccess in the WordPress root.
# Generated by WP Security Ninja # https://wpsecurityninja.com/tools/htaccess/ # Paste above # BEGIN WordPress. Leave that block alone. # Backup your current .htaccess first. <Files "wp-config.php"> Require all denied </Files> <FilesMatch "^\.ht"> Require all denied </FilesMatch> Options -Indexes
Second file: wp-content/uploads/.htaccess
Put this file in wp-content/uploads/ as .htaccess.
# Generated by WP Security Ninja # https://wpsecurityninja.com/tools/htaccess/ # Place this file at wp-content/uploads/.htaccess <FilesMatch "\.php$"> Require all denied </FilesMatch>
After you upload
Backup first. Then check these in the browser. A 500 means restore the old file over SFTP.
- Homepage, a post, and /wp-admin/ still load.
- yoursite.com/wp-config.php must not show PHP.
- yoursite.com/wp-content/ must not list files.
- If the site returns 500, restore the backup over SFTP.
Let the plugin do this without editing server files
Security Ninja’s free tests cover many of the same protections (directory listing, xmlrpc, headers) from wp-admin. Pro adds Cloud Firewall and login tools so you are not maintaining a private rulebook.
Longer notes, rollback, and Apache 2.2 vs 2.4: the .htaccess security guide.
Common questions
What is .htaccess in WordPress? +
It is an Apache config file in the site root, next to wp-config.php. WordPress uses it for permalinks. You can add a few extra rules for file protection and HTTPS. It is not a full security stack.
Where is my WordPress htaccess file? +
In the WordPress root (the same folder as wp-config.php and wp-login.php). File managers hide names that start with a dot. Turn on hidden files, or create the file if it is missing.
Why is my htaccess file hidden in WordPress? +
The filename starts with a dot, so FTP clients and many host file managers hide it by default. Enable “show hidden files” and look again.
How do I edit a htaccess file in WordPress? +
Download a backup first. Edit with a plain-text editor over SFTP or the host file manager. Paste extra rules above # BEGIN WordPress. Do not use Word. After saving, load the homepage, a post, and /wp-admin/. If the site returns 500, restore the backup.
Can a bad .htaccess take the site down? +
Yes. A typo or a rule your host does not support can return HTTP 500. Keep a copy of the current file and a restore path that does not need wp-admin.
Does this work on Nginx? +
No. Nginx ignores .htaccess. Put the equivalent rules in the server block or the host panel. LiteSpeed often honors Apache-style rules, but test one change at a time.
Why do my custom rules disappear? +
WordPress overwrites everything between # BEGIN WordPress and # END WordPress when you save permalinks. This generator puts extra rules above that block. Leave the markers intact.
Should I replace the whole file? +
No. Paste the generated rules above # BEGIN WordPress unless the file is missing. If it is missing, turn on Include WordPress permalink rules and use that complete file.
