Moayyad Faris
Security

Processed locally in your browser — not uploaded

WordPress & Apache Security .htaccess Generator

Generate modular, production-ready Apache .htaccess rules for WordPress and web applications. Features 8 categorized configuration tabs: Force HTTPS & canonical www/non-www, custom 301 & 302 redirects, IP/CIDR blocklists, WordPress core shields (wp-config.php, XML-RPC, PHP in uploads), HTTP Basic Authentication, security headers (HSTS, X-Frame-Options), directory browsing control, sensitive file access rules (.env, .git), and Gzip / browser asset caching. Runs 100% locally in your browser.

Preset:

HTTPS & Domain Canonicalization

Enforce SSL encryption and unify www vs non-www domain canonicalization for SEO.

Canonical Domain Prefs (www vs non-www)
# ====================================================================
# HARDENED PRODUCTION .HTACCESS CONFIGURATION
# Generated via Moayyad Faris Web & Security Tools
# ====================================================================

# 1. FORCE HTTPS & CANONICAL DOMAIN REWRITES
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{HTTPS} !=on
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

# 2. WORDPRESS CORE SECURITY HARDENING
# Shield wp-config.php database credentials
<Files wp-config.php>
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</Files>
# Block XML-RPC pingbacks & brute force attacks
<Files xmlrpc.php>
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</Files>
# Prevent Remote Code Execution (RCE) in uploads directory
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteRule ^wp-content/uploads/.*\.(php|phps|php5|php7|phtml)$ - [F,L]
</IfModule>
# Stop username harvesting via author query enumeration
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{REQUEST_URI} !^/wp-admin
  RewriteCond %{QUERY_STRING} (author=\d+) [NC]
  RewriteRule .* - [F,L]
</IfModule>

# 3. CUSTOM URL REDIRECTS (SEO & SITE MIGRATIONS)
Redirect 301 /old-page /new-page

# 4. IP ACCESS BLOCKLIST & RESTRICTIONS
<RequireAll>
  Require all granted
  Require not ip 192.0.2.1
</RequireAll>

# 6. HTTP SECURITY & PRIVACY HEADERS
<IfModule mod_headers.c>
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS
  Header unset Server
  Header unset X-Powered-By
</IfModule>

# 7. DIRECTORY LISTING & CUSTOM ERROR DOCUMENTS
Options -Indexes
ServerSignature Off
ErrorDocument 404 /404.html

# 8. BLOCK ACCESS TO REPOSITORY & SYSTEM FILES
RedirectMatch 404 /\.git
<FilesMatch "(\.env|^\.ht|^(readme|license|changelog)\.(html|txt|md)$|\.(bak|config|sql|fla|psd|ini|log|sh|swp|old|save|tmp)$)">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>

# 9. PERFORMANCE & BROWSER ASSET CACHING
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript application/json image/svg+xml
</IfModule>
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresDefault "access plus 1 month"
  ExpiresByType image/jpg "access plus 30 days"
  ExpiresByType image/jpeg "access plus 30 days"
  ExpiresByType image/gif "access plus 30 days"
  ExpiresByType image/png "access plus 30 days"
  ExpiresByType image/webp "access plus 30 days"
  ExpiresByType text/css "access plus 30 days"
  ExpiresByType application/javascript "access plus 30 days"
</IfModule>
<IfModule mod_headers.c>
  Header set Cache-Control "max-age=2592000, public"
</IfModule>

# ====================================================================
# STANDARD WORDPRESS REWRITE DIRECTIVES
# ====================================================================
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
Encoding: UTF-8Apache 2.4
01

How to use

  1. Select a pre-configured starter preset (e.g. WordPress Hardened, Maximum Security, SEO Redirects, High Performance) or build a custom configuration.
  2. Navigate through the interactive tabs to configure Force HTTPS, 301/302 Redirects, IP Blocking, HTTP Basic Auth, Security Headers, and Directory Browsing rules.
  3. Inspect the live, auto-generated production .htaccess file in the right-hand code drawer.
  4. Click 'Copy .htaccess' or 'Download .htaccess' and place the file in your web server root directory (/public_html/).
  5. Test your website to verify redirects and administrative access functionality.
02

Understanding the output

The generator produces modular, standards-compliant Apache HTTPD `.htaccess` directives. It combines HTTPS domain canonicalization, WordPress core shields (`wp-config.php`, `xmlrpc.php`), custom 301/302 URL redirects, IP/CIDR blocklists, HTTP security headers (`HSTS`, `X-Frame-Options`), directory listing options, sensitive file protections, and `mod_deflate`/`mod_expires` caching rules.

03

Common issues & tips

  • •Always maintain a backup copy of your original `.htaccess` file prior to overwriting it on live production servers.
  • •Order matters in `.htaccess`: Force-HTTPS rewrite rules execute at the top, followed by security restrictions, URL redirects, headers, and standard WordPress rewrite blocks.
  • •If your host runs Nginx or Microsoft IIS instead of Apache, `.htaccess` directives will be ignored. Use our Nginx Config Security Analyzer for Nginx server rules.

Frequently asked questions

Where do I upload the generated .htaccess file?
Upload it to your web server root directory (usually /public_html/ or /www/) replacing or supplementing your existing .htaccess file. Always back up your existing file first.
Does .htaccess work on Nginx or Microsoft IIS?
No. .htaccess directives are specific to Apache HTTPD and LiteSpeed servers. Nginx uses nginx.conf and IIS uses web.config. If your host runs Nginx, use our Nginx Config Security Analyzer instead.
What is the difference between 301 and 302 redirects in .htaccess?
A 301 redirect signals a permanent move, transferring SEO link equity to the target URL. A 302 redirect is temporary and tells search engines to keep indexing the original URL.
Will blocking XML-RPC break my site?
xmlrpc.php is used by legacy mobile apps and Jetpack. If you do not use Jetpack or mobile publishing apps, disabling it eliminates a major brute-force attack vector.
Does this generator support Apache 2.4 and Apache 2.2?
Yes! You can toggle between modern Apache 2.4 syntax (Require all denied / Require not ip) and legacy Apache 2.2 syntax (Order allow,deny / Deny from all) in the toolbar.

Related tools

Security Header Analyzer

Check which security headers a site sends, with plain-language explanations.

Nginx Config Security Analyzer

Audit nginx.conf for security vulnerabilities, missing HSTS/CSP headers, and weak SSL protocols.

CORS Header Generator & Simulator

Generate CORS headers for Express, NestJS, Nginx, API Gateway, and test pre-flights.

Related guides

Hardening Docker & Nginx Production Workloads for High-Concurrency Next.js Applications

Learn how to harden Next.js Docker containers and Nginx reverse proxies for production. Covers non-root multi-stage Dockerfiles, Nginx security headers, rate-limiting zones, and CloudFront origin secret validation.