{"id":839569,"date":"2018-10-30T12:09:39","date_gmt":"2018-10-30T11:09:39","guid":{"rendered":"https:\/\/wp-rocket.me\/?p=839569"},"modified":"2021-07-29T10:08:06","modified_gmt":"2021-07-29T08:08:06","slug":"htaccess-use-wordpress","status":"publish","type":"post","link":"https:\/\/wp-rocket.me\/blog\/htaccess-use-wordpress\/","title":{"rendered":"What is .htaccess and How to Use it With WordPress"},"content":{"rendered":"

WordPress relies on several core files to run your website and the powerful .htaccess configuration file is one of them.<\/span><\/p>\n

Short for \u201chypertext access,\u201d WordPress uses this file primarily to handle pretty permalinks. But its true power lies in its ability to override your server\u2019s settings\u2014enabling you to add your own rules to this file that can beef up your site\u2019s performance and security.<\/span><\/p>\n

Some of this additional functionality includes locking outside access to critical files, sending custom HTTP heads, forcing SSL, and restricting access to the WordPress dashboard.<\/span><\/p>\n

In this post, we\u2019ll take a look at how .htaccess works and how to edit it. Plus, we\u2019ll look at some examples of what you can do with this file to improve your site\u2019s performance.<\/span><\/p>\n

\"htaccess<\/p>\n

What is the .htaccess File?<\/span><\/h2>\n

The .htaccess file is a configuration file that WordPress uses for Apache web servers. Since most WordPress web hosts use Apache, most WordPress websites also have a .htaccess file.<\/span><\/p>\n

This file is usually located in the root directory of your site. But since it sets out how Apache should handle configuration for your site on a per-directory basis, you might also find versions of this file in other folders on your site.<\/span><\/p>\n

It\u2019s a hidden file\u2014that\u2019s why it starts with a period\u2014and it has no extension. This means you won\u2019t be able to see it when browsing your files unless you show all hidden files on your computer.<\/span><\/p>\n

In WordPress, .htaccess has one important function: it controls how your site\u2019s permalinks are displayed. The file is automatically generated the first time you customize your permalinks, and if you make any subsequent changes to your permalink structure the file is automatically updated with new rules.<\/span><\/p>\n

For many small and basic WordPress sites, handling permalinks is all the .htaccess will ever do. But for more larger and more complex sites, .htaccess is often manipulated by plugins. This is especially common for security and caching plugins like WP Rocket, which\u00a0<\/span>edits .htaccess to enable GZIP compression for your site<\/span><\/a> and adds the optimal browser caching rules.<\/span><\/p>\n

It\u2019s also possible to make your own changes to .htaccess to enable\/disable advanced functionality on your site. In fact, there\u2019s a lot you can do, such as prevent directory browsing, restrict access to PHP files, and even protect your site against script injections.<\/span><\/p>\n

How to Find the .htaccess File in WordPress<\/span><\/h2>\n

The .htaccess file is located in the root directory of your site. But before you go hunting around for it and making changes, it\u2019s important to understand that editing this file comes with risks\u2014a single syntax error could mess with key functionality, or even break your site.<\/span><\/p>\n

Getting Started: Create a Backup<\/span><\/h3>\n

So make sure you back up your site before editing this file. Alternatively, you could use a staging site to update .htaccess and test changes to your site\u2019s functionality before pushing them live.<\/span><\/p>\n

If you prefer to fly by the seat of your pants and edit your site live, it\u2019s a good idea to download a copy of your .htaccess file to your computer so you at least have a backup. This way, if you do break your site, you can simply upload the original copy of the file to your server and pretend like nothing happened.<\/span><\/p>\n

There are typically three ways you can access your .htaccess file:<\/span><\/p>\n

1. Editing .htaccess Using cPanel<\/span><\/h3>\n
    \n
  1. Log into cPanel for your site and go to \u201cFile Manager.\u201d<\/span><\/span><\/span><\/span><\/li>\n
  2. File Manager will load and display a list of files on your web server. Look for \u201c<\/span>public_html<\/span><\/i>\u201d and click on that.<\/span><\/span><\/span><\/span><\/li>\n
  3. You are now in the root directory for your website (unless you set up your site in a sub-directory). Scroll through your files and look for the .htaccess file:<\/span><\/li>\n<\/ol>\n

    \"how<\/p>\n

    If you can\u2019t see the file, you\u2019ve either not got one or you need to change your settings for hidden files.<\/span><\/p>\n

    To update hidden files settings, click on \u201cSettings\u201d in the top-right corner of File Manager and in the modal that appears check \u201cShow Hidden Files.\u201d<\/span><\/p>\n

    <\/p>\n

    2. Editing .htaccess Using FTP<\/span><\/h3>\n

    1. Grab your FTP details and log in to your site using your favorite FTP app (I\u2019m using FileZilla).<\/span><\/span><\/span><\/span><\/p>\n

    2. Once your FTP client is connected to your site, you should see your server\u2019s root files in the bottom-right quadrant, like so:<\/span><\/p>\n

    \"how<\/p>\n

    3. Scroll through the list of files until you find \u201c<\/span>public_html<\/span><\/i>\u201d and then double-click it.<\/span><\/span><\/span><\/span><\/p>\n

    4. You\u2019ll now be in your site\u2019s root directory (unless, of course, you set up WordPress in a sub-directory). Scroll through the files listed and you should see your .htaccess file:<\/span><\/p>\n

    \"htaccess<\/p>\n

    3. Editing .htaccess Using a Plugin<\/span><\/h3>\n

    There are many free plugins that can enable you to edit the .htaccess file, but one of the most popular is Yoast SEO.
    <\/span>To access your .htaccess file in the WordPress dashboard:<\/span><\/p>\n

    1. Log in to your site and navigate to <\/span>SEO > General<\/b>.<\/span><\/span><\/span><\/span><\/p>\n

    2. In the tab at the top of the page, click on \u201cFeatures\u201d and then scroll down to “Security: no advanced settings for authors\u201d and turn this option off. Save your changes.<\/span><\/span><\/span><\/span><\/p>\n

    3. Next, go to <\/span>SEO > Tools<\/b> and you should see a \u201cFile editor\u201d option. This tool allows you to make changes to your .htaccess file.<\/span><\/p>\n

    Note: If file editing is disabled on your site, as it is on mine (hence the lack of imagery here), then you won\u2019t see this option in your WordPress install. You\u2019ll need to use another method for accessing your .htaccess file.<\/span><\/p>\n

    Creating a <\/span>.htaccess<\/span><\/i> File If You Don\u2019t Already Have One<\/span><\/h2>\n

    If you don\u2019t have a .htaccess file in your root directory you may need to create one. But first, double-check that you definitely have hidden files showing so you don\u2019t inadvertently create a second copy (and replace your original file by accident).<\/span><\/p>\n

    The easiest way to create one is to simply go to <\/span>Settings > Permalinks<\/b> in the WordPress dashboard and click \u201cSave Changes.\u201d WordPress will automatically generate a file, and you don\u2019t actually have to switch to different permalink settings.<\/span><\/p>\n

    Alternatively, if you want to create and edit and contents of your file, here\u2019s how to create one using cPanel:<\/span><\/p>\n

    1. In File Manager, go to your root directory (<\/span>public_html<\/span><\/i>).<\/span><\/span><\/span><\/span><\/p>\n

    2. Click \u201cFile\u201d in the top-left and enter .htaccess. Click \u201cCreate New File\u201d:<\/span><\/span>\"how<\/p>\n

    3. The root directory will refresh and you should see your newly created .htaccess file listed amongst your files.<\/span><\/p>\n

    Since all WordPress installs have pretty permalinks turned on by default (since WordPress 4.2), it\u2019s a good idea to include the basic rules that are default for .htaccess files in newer versions of WordPress rather than having an empty file.<\/span><\/p>\n

    So you\u2019ll need to edit your blank .htaccess file to enter these rules.
    <\/span>While still in your root directory, make sure .htaccess is selected and click the \u201cEdit\u201d option at the top of the page:<\/span><\/p>\n

    \"how<\/p>\n

    A new tab will open where you can add the following configuration rules:<\/span><\/p>\n

    \"how<\/p>\n

    For Multisite networks and other versions of WordPress, you\u2019ll need to enter different rules. You can find the full list of<\/span> default .htaccess file rules in the WordPress Codex<\/span><\/a>. <\/span><\/p>\n

    Editing the .htaccess File <\/span><\/h2>\n

    There are a few important things to know when making changes to the .htaccess file.<\/span><\/p>\n

    Firstly, lines that begin with a hashtag are comments, not actual rules. So these lines don\u2019t really do anything other than provide handy markers amongst the text to tell you where rules start and end.<\/span><\/p>\n

    Secondly, when adding new rules you should insert them either above or below the default WordPress rules. You shouldn\u2019t add or edit anything between the lines that start with <\/span># BEGIN WordPress<\/code><\/span> and <\/span># END WordPress<\/code><\/span>. <\/span><\/p>\n

    Generally, the norm is to add any new rules below the default WordPress instructions. This way, you\u2019ll always know that the WordPress rules are at the top of the file and any new rules are listed out below.
    Nevertheless, WP Rocket represents an exception in this sense<\/strong>: its rules need to be placed right at the top of the .htaccess file;     the plugin will automatically add them<\/a>, so you don’t need to edit anything in this case.<\/span><\/p>\n

    You might also want to consider adding in your own comments, especially if you add lots of new rules around security and performance to your file as it could quickly get messy. Comments can help you quickly find rules, track what\u2019s changed, and keep your file organized.<\/span><\/p>\n

    When adding new rules to .htaccess, it\u2019s a good idea to save your changes and refresh your site to check that your site is still functioning properly. This will also tell if any particular rules break your site, and if they do you can simply remove the troublesome rule or upload a backup of your .htaccess to get your site working properly again.<\/span><\/p>\n

    Examples of .htaccess Rules for WordPress<\/span><\/h2>\n

    Adding new rules to your .htaccess file lets you take back more control over your site and server and make changes that boost your site performance.<\/span><\/p>\n

    Before we dive in, though, make sure you duplicate your .htaccess file so you\u2019ve got a backup. You may find that your web host doesn\u2019t support some of the rules or you may inadvertently make a typo and break your site.<\/span><\/p>\n

    Whatever the case may be, the easiest thing is to simply make a copy of .htaccess and rename it something like<\/span> .htaccess_original<\/span><\/i>. This way, when you\u2019re making changes to your file and discover that you need to roll back, all you need to do is rename the file and upload it to your root directory.<\/span><\/p>\n

    Enable HTTP Compression<\/span><\/h3>\n

    All modern browsers support and automatically negotiate GZIP compression for all HTTP requests. Enabling GZIP,<\/span> as I wrote about on this blog a couple of weeks back<\/span><\/a>, can often achieve compression rates as high as 70-90%. This can significantly reduce the amount of time it takes to download resources, reduce data usage for site visitors, and improve the time to first render of your pages.<\/span><\/p>\n

    Now, it\u2019s important to point out here that WP Rocket adds GZIP compression rules to your .htaccess file automatically using the mod_deflate module. So if you\u2019re using WP Rocket, you don\u2019t have to do anything\u2014GZIP is already enabled and working on your site.<\/span><\/p>\n

    But to give you an idea of what the <\/span>mod_deflate<\/span> module looks like, here\u2019s a simplified version:
    <\/span>
    <ifmodule mod_deflate.c><\/span>
    \n<\/span>AddOutputFilterByType DEFLATE <\/span>text<\/span>\/html <\/span>text<\/span>\/plain <\/span>text<\/span>\/xml <\/span>application<\/span>\/xml <\/span>application<\/span>\/xhtml+xml <\/span>text<\/span>\/javascript <\/span>text<\/span>\/css <\/span>application<\/span>\/x-javascript <\/span>application<\/span>\/javascript<\/span>
    \n<\/span><\/ifmodule><\/span><\/code><\/p>\n

    Prevent Image Hotlinking<\/h3>\n

    Every image on your pages sends a separate HTTP request to your server. So when someone uses the URL for one of your images and adds it to their site instead of uploading the image to their server, they\u2019re stealing your bandwidth.<\/span><\/p>\n

    This technique is known as hotlinking. To stop this happening to your site, add the following to your .htaccess file:<\/span>

    \nRewriteEngine<\/b> on<\/span>
    \n<\/span>RewriteCond<\/b> %{HTTP_REFERER}<\/span> !^$<\/span>
    \n<\/span>RewriteCond<\/b> %{HTTP_REFERER}<\/span> !^http:\/\/(www\\.)?yourdomain.com\/.*$<\/span> [NC]<\/span>
    \n<\/span>RewriteRule<\/b> \\.(gif|jpg|png)$ -<\/span> [F]<\/span><\/code><\/p>\n

    Make sure you replace \u201cyourdomain.com\u201d with your site\u2019s URL.<\/p>\n

    For more examples of .htaccess rules to help you boost your site\u2019s performance and security, check out the\u00a0<\/span>htaccess entry in the WordPress Codex<\/span><\/a>.<\/span><\/p>\n

    <\/div>\n\t