.htaccess Generator for WordPress

Build a safe WordPress .htaccess with HTTPS, www rules, GZIP, caching, security headers and 301 redirects.

---

A broken .htaccess file takes a WordPress site down with a 500 error, and a missing rule leaves it slower and less secure than it should be. This generator builds a clean file from a set of switches, keeps the standard WordPress block intact, and gives you a second small file that stops PHP running inside your uploads folder.

How to use it

1. Choose whether you want www, non-www, or neither forced.
2. Tick the features you want: HTTPS redirect, GZIP, browser caching, security headers and so on.
3. Add any 301 redirects, one per line, in the form /old-path /new-path.
4. Copy the result and replace the contents of the .htaccess file in your site's root folder.
5. Save the second file as wp-content/uploads/.htaccess if you want PHP blocked in uploads.

Always keep a copy of your current .htaccess before replacing it. If the site shows a 500 error, restore the old file and untick the last option you added.

What each option does

Force HTTPS sends every http request to https with a permanent redirect. GZIP shrinks text files before they travel, which usually cuts transfer size by two thirds. Browser caching tells visitors' browsers to keep images, fonts, CSS and JavaScript for up to a year, so repeat visits load much faster. The security headers stop browsers guessing file types, embedding your site in frames on other domains, and leaking full URLs in the referrer.

Questions people ask

I get "too many redirects" after forcing HTTPS. Why?

Your site is probably behind Cloudflare or a load balancer that talks to the server over plain HTTP. Tick "Behind Cloudflare or a proxy" and regenerate.

Does this work on Nginx?

No. .htaccess is read by Apache and LiteSpeed only. On Nginx the same rules go into the server configuration.

Should I block xmlrpc.php?

If you do not use Jetpack, the WordPress mobile app or pingbacks, yes. It is a common target for brute-force attacks. If you do use them, leave it off.

Will the redirect lines hurt my SEO?

No. A 301 passes ranking signals to the new address. Keep the list short and avoid chains where A goes to B and B goes to C. This tool runs entirely inside your web browser. Nothing you type is uploaded to a server, so there is no queue and no copy of your data left behind when you close the tab.