WordPress .htaccess Generator

Domain (for www / non-www redirects)

Standard WordPress permalinks block Force HTTPS WWW: Browser caching (Expires headers) Gzip compression (mod_deflate) Protect wp-config.php Disable directory browsing Block xmlrpc.php

.htaccess

Place at your WordPress root. Keep the permalinks block between the # BEGIN WordPress markers.

The standard WordPress block

WordPress needs a small mod_rewrite block — between # BEGIN WordPress and # END WordPress — to route pretty permalinks through index.php. WordPress writes it for you when permalinks are saved, but a lost or emptied .htaccess breaks every URL except the home page. This regenerates it.

Redirects

Force HTTPS and the www / non-www options add canonical redirects above the WordPress block so they run first. Pick one www direction and stick with it — redirect loops usually come from also forcing the opposite elsewhere (a plugin or server config).

Performance & hardening

Caching and gzip add Expires headers and compression for faster repeat visits. Protect wp-config.php, disable directory browsing and block xmlrpc.php are common hardening steps. Only block XML-RPC if nothing you use needs it (some apps and Jetpack features do).

Testing rules

To check how a specific RewriteRule or Redirect behaves against a path, use the .htaccess Tester.

Frequently asked questions

WordPress overwrote my .htaccess — is that normal?

WordPress rewrites the block between # BEGIN WordPress and # END WordPress when you save permalinks. Keep custom rules (redirects, caching) outside those markers so they aren't touched.

My site redirects in a loop after enabling HTTPS/www. Why?

Usually something is forcing the opposite direction too — a plugin, a reverse proxy, or a second rule. Pick one HTTPS/www direction and make sure nothing else contradicts it.