Home / Tools
Tools

.htaccess Generator for WordPress

Select the rules you need and the tool assembles a ready-to-use .htaccess file for an Apache or LiteSpeed server. It is a simple yet effective way to harden WordPress security: protecting login, blocking sensitive files and attack vectors before PHP even runs. Everything is computed in your browser; no data is sent to a server. After generating, copy the contents or download the file and upload it to your site's root directory. Always make a backup of the existing file before overwriting.

The standard rewrite block required by WordPress (permalinks). If you are editing an existing file, this block is usually already there.

Redirects all traffic from http to https (301).

Blocks direct access to the configuration file containing your database credentials.

Disables a common brute-force and DDoS amplification vector. Note: it also blocks the WordPress mobile app and some plugins (e.g. Jetpack).

Restricts access to login: by .htpasswd password, by IP address, or "IP or password". An effective barrier against brute-force attacks on the panel.

Blocks browser access to .htaccess and .htpasswd.

Prevents showing directory contents when there is no index.php (e.g. /wp-content/uploads).

Compresses text, CSS, JS and HTML for faster page loads.

Sets a long cache time for images, CSS and JS. Helps Core Web Vitals.


                    
Place the rules in your site's root directory. The WordPress core block must stay between the # BEGIN WordPress and # END WordPress markers — WordPress may overwrite it. After uploading, verify that the site and login work; restore the backup if anything breaks.

                

            

        

    


    

        

            

                
What the .htaccess file is and what it does

                
The .htaccess file is a configuration file for the Apache server (and the compatible LiteSpeed), operating at the level of a single directory. It lets you influence how the server handles requests: routing redirects, blocking access to sensitive files, enabling compression and caching, or setting headers, without touching the main server configuration. In WordPress, .htaccess is mainly responsible for handling friendly URLs (permalinks) and is the natural place for security and performance rules. This generator assembles a ready-made file from the rules you select, and below we explain what each one does.

            


            

                
How to use the generated file step by step

                

                    

                        1. Back up
                        Download the current .htaccess from your site's root via FTP or your hosting file manager and save it locally. That is your way back if something goes wrong. See our article on WordPress backups.
                    

                    

                        2. Select rules
                        Tick the rules you need above and fill in the data (domain, redirects). The preview on the right updates live. If you are editing an existing file, the WordPress core block is usually already there, so do not duplicate it.
                    

                    

                        3. Upload the file
                        Copy the contents or download the file and place it in the root directory (where wp-config.php is). The file name is exactly .htaccess, with a leading dot and no extension.
                    

                    

                        4. Test
                        Open the home page and a few subpages, and check the admin login. A 500 error means a syntax problem, most often a missing required module. Then restore the backup and add rules one at a time.
                    

                

            


            

                
What the individual rules do

                

                    

                        Force HTTPS
                        Redirects all http traffic to https with a 301 code, so users and search engines always reach the encrypted version. Works together with a certificate, covered in our article on SSL and HTTPS in WordPress.
                    

                    

                        www / non-www canonicalization
                        Picks one canonical address variant and redirects the other to it. Prevents both versions being treated as separate URLs, which would dilute SEO signals.
                    

                    

                        301 redirects
                        Permanently move an old address to a new one, preserving Google rankings and guiding users from outdated links. Essential after a URL structure change, migration or removing pages. More in our article on 301 redirects and 404 errors.
                    

                    

                        Protect wp-config and .ht* files
                        Blocks direct browser access to the file with database credentials and to configuration files. A basic element of WordPress security.
                    

                    

                        Login protection
                        Restricts access to wp-login.php or the whole wp-admin: by Basic Auth password (.htpasswd), by IP address, or in "IP or password" mode (RequireAny) — you enter from trusted addresses without a password, others must log in. The most effective barrier against brute-force attacks on the panel; more in our article on WordPress login protection.
                    

                    

                        Block xmlrpc.php
                        Disables a frequently abused entry point for brute-force attacks and DDoS amplification. Note: it also blocks the WordPress mobile app and some plugins, so enable it deliberately.
                    

                    

                        Image hotlink protection
                        Stops other sites from embedding your images directly from your server (bandwidth theft). The rule allows requests with no referrer and those from your own domain, while images loaded from foreign pages are blocked with a 403. It protects bandwidth and server resources, but set the allowed domain deliberately so you don't block, for example, social media link previews.
                    

                    

                        GZIP and browser caching
                        Compression reduces the size of transferred files, and caching lets the browser avoid downloading them every time. Both improve load time and Core Web Vitals.
                    

                

            


            

                
Frequently asked questions about .htaccess

            

            

                
A configuration file for the Apache server (and LiteSpeed) working at the directory level. It controls redirects, file access, compression, caching and headers without changing the main configuration. WordPress uses it for permalinks.

                
In the root directory of the installation, where wp-config.php and index.php are. The rules cover that directory and all subdirectories. The mod_rewrite module is required on the server.

                
No. It is supported by Apache and LiteSpeed. Nginx does not read .htaccess; equivalent rules are configured in the server block. The differences between servers are covered in our article on Apache, Nginx and LiteSpeed.

                
Yes, a syntax error causes a 500 error. So back up before editing and check the site after uploading. If there is a problem, restore the previous version of the file.

                
No. The file is built in the browser with JavaScript. The domains and addresses you enter are not sent or stored anywhere outside your device.

            


            

                
Tool and write-up: Marcin Szewczyk-Wilgan, WebOptimo. Rules based on practical configuration of Apache, Nginx and LiteSpeed servers for production WordPress installations. The generator runs entirely in the browser, with no data sent.

            

        

    


    
Contact
Need help with server configuration?
We handle Apache, Nginx and LiteSpeed configuration for WordPress: redirects, security, performance. No obligation — a concrete proposal after a short conversation.
Phone
+48 608 271 665
Mon–Fri, 8:00–16:00
E-mail
kontakt@weboptimo.pl
We reply within 24h
Company
WebOptimo
VAT ID: PL6391758393











	Marcin Szewczyk-Wilgan - m4c.pl  Powered by FreeBSD  Edited in Vim