You can use the .htaccess file to specifically improve the behavior of your WordPress website - without a plugin. Among other things, you can use it to regulate 301 redirectsincrease the Security and optimize your WordPress pagespeed.
In short: you make your website more efficient, more secure and more user-friendly. In this article, you will learn how to create and edit a .htaccess file in WordPress and which settings are particularly useful.
What is an htaccess file in WordPress?
The .htaccess file (Hypertext Access) is a configuration file that is used on Apache web servers - including many WordPress websites. It controls server-side settings, before WordPress is even loaded.
In WordPress, the .htaccess file is typically used for
- Change permalinks (adapt URL structure): So that yourpage.com/?p=123 becomes e.g. yourpage.com/my-post-title
- Forwarding: Redirect visitors from your domain to another domain
- Safety rulesDefine HTTP security headers and protect sensitive areas or block IP addresses
- Performance optimizationActivate caching or compress content for faster loading times
The .htaccess file is a powerful tool for Functions, security and performance of your WordPress site without changing the CMS itself.
💡Important note: In addition, the .htaccess can also be responsible for ensuring that the design and functionality of your website are displayed correctly. If there are incorrect entries in your .htaccess, this can break your website.
Where can I find the file?
You can find the .htaccess file in the Root directory of your WordPress installationwhere files such as wp-config.php, wp-login.php and the wp-content, wp-admin and wp-includes folders are located.
How to find them:
1. via an FTP program (e.g. FileZilla)
- Connect to your web server.
- Change to the main directory of your website.
- Attention: .htaccess is a hidden file. Activate the display of hidden files in your FTP program (in FileZilla under Server → Force listing of hidden files).
2. via the file manager of your hosting provider
- Log in to the customer area of your Hosters to.
- Go to the file manager
- Navigate to the root directory of your WordPress.
- Make sure that hidden files are also displayed here.
3. the file is not there?
In some cases, the .htaccess file is not yet available, such as with some new WordPress installations. You can then Create manually (simply create a file called .htaccess and fill it as in the next section) or in WordPress under Settings → Permalinks save the structure. WordPress then creates the file automatically, provided the server has write permissions.
💡Note: If you do not rely on an Apache server as with WPspace, but on a WordPress hosting with nginx caching, you do not have a .htaccess file by default. The commands it contains must be adapted to nginx caching, otherwise you will destroy your WordPress website.
How do you set up htaccess in WordPress?
Setting up the .htaccess file in WordPress is easy if you know what's important. Here you can find out step by step how to create and configure the file correctly.
1. check whether an .htaccess file already exists
- Open the root directory of your WordPress installation (via FTP or file manager).
- Make sure that hidden files are visible.
- If an .htaccess file exists, you can edit it. If not, create a new one (see next step).
2. Create .htaccess file (if not available)
- Create a new .txt file with a program such as Notepad++ or Sublime and name it exactly .htaccess (without file extension).
- Upload them to the root directory of your WordPress installation.
3. insert standard code for WordPress
If you want to create a clean new .htaccess, you can simply insert the following code:
# BEGIN WordPress
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
# END WordPress💡 Tip: If you are under Settings → Permalinks structure, WordPress automatically creates these rules if the file is writable.
4. add your own rules (optional)
For example, if you want to define your own redirect rules via .htaccess, you can simply add the required lines of code to your .htaccess. You can insert additional lines of code before or after the WordPress block, e.g:
Forwarding:
Redirect 301 /old-page https://deineseite.de/neue-seiteAccess protection:
Order deny,allow
Deny from allForwarding from with www. to without www.
RewriteEngine On
RewriteCond %{HTTP_HOST} !^www\.domain\.de$ [NC]
RewriteRule ^(.*)$ http://www.domain.de/$1 [L,R=301]💡 Note: If you set this rule via your .htaccess, this can lead to the error "Too many redirects". By default, you make this change directly in WordPress. This applies to both directions: from with www. to without www. and vice versa.
Caching and compression:
ExpiresActive On
ExpiresByType image/jpg "access plus 1 year"
...5. save and test the file
- Save changes and upload file (if edited locally).
- Open the WordPress website and check that everything works as expected.
What is part of .htaccess?
The .htaccess file contains Rules and instructionswith which you can directly influence the behavior of the web server (Apache) even before WordPress is loaded. It works like a kind of "control center" for certain server-side functions.
Typical components of an .htaccess file are
Standard code
This code should always be part of your .htaccess to ensure the functionality of your website:
# BEGIN WordPress
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
# END WordPressThe following rules in the form of lines of code can be added to your .htaccess. It is best to always add them after "# END WordPress".
URL rewrites (rewrite rules)
Important for permalinks in WordPress. Example:
RewriteEngine On
RewriteRule ^example$ /index.php?page=example [L]Access restrictions
Protect certain files or directories from unauthorized access:
Order deny,allow
Deny from allForwarding
Automatically redirect visitors from one URL to another:
Redirect 301 /old-page https://deinewebsite.de/neue-seiteCaching and performance optimization
Ensure faster loading times through browser caching or compression:
ExpiresActive On
ExpiresByType image/png "access plus 1 year"Safety rules
Prevent access to hidden files or secure sensitive areas, for example:
Order deny,allow
Deny from all.htaccess example for WordPress with security rule
# BEGIN WordPress
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
# END WordPress
# Security: Block access to wp-config.php
Order deny,allow
Deny from allWhat does this example do?
- WordPress part (above):
Ensures that permalinks (e.g. domain.com/example-page) are called up correctly. - Safety rule (below):
Prevents direct access to the wp-config.php file, which contains sensitive data such as your database access data.
Frequently asked questions about the WordPress.htaccess file in WordPress
Can I simply edit the .htaccess file?
Yes, but be careful. Even a small error can result in your website no longer being accessible. It is best to always make a backup copy of the existing file before you make any changes.
How do I restore the default content of the WordPress .htaccess?
Here is the standard code required for permalinks in a typical WordPress installation:
# BEGIN WordPress
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
# END WordPress💡 Note: If your WordPress website requires specific lines of code for a plugin, the plugin will automatically add the code back to the .htaccess.
Can I make my site more secure with the .htaccess file?
Yes, in any case. For example, you can block access to sensitive files, lock out IP addresses or protect directories. Such measures significantly increase security - especially against bots or simple attack attempts.
Do I need to have programming knowledge to use .htaccess?
Not necessarily. You can implement many common use cases with ready-made code snippets. Some basic technical understanding helps, but you don't need to be a professional - you just need to be careful.
Why .htaccess is important for SEO:
The .htaccess file is a technical SEO toolwhich helps to make your WordPress site search engine friendly and powerful. It is therefore worth considering them not only as a security or performance element, but also as part of Your SEO strategy.
What are HTTP Security Headers?
The HTTP security headers are additional security rules that are inserted via your .htaccess file. There are different security headers that protect websites from different types of attacks.
For example, you can use X-Frame-Options to protect your website from being integrated into other websites via iFrame. The most common security header is probably the "Content-Security-Policy (CSP)". You use this security rule to determine which content may be loaded. Caution: Make sure you have the correct exceptions so that all functions such as Google Maps, YouTube, newsletters or similar continue to work on your website
Conclusion on the WordPress .htaccess file
The .htaccess file is a powerful tool with which you can specifically influence the behavior of your WordPress website at server level. even before WordPress itself becomes active. Whether for SEO-friendly URLs, better loading times, more security or targeted redirects: Just a few lines of code can make a noticeable difference. It is important to always proceed with caution and to carry out a thorough Create a backup of the file. This allows you to use the full potential of .htaccess without taking any risks.
