Moayyad Faris
Security

Processed locally in your browser — not uploaded

WordPress Security .htaccess Generator

Generate modular Apache .htaccess security rules tailored for WordPress platforms. Features interactive toggles to protect wp-config.php, block XML-RPC brute force attacks, disable directory browsing, block PHP execution in /wp-content/uploads/, prevent author enumeration, and inject security headers. Runs entirely in your browser.

🔒 Production Hardened WordPress Setup

WordPress Hardening Rules

# ====================================================================
# HARDENED WORDPRESS .HTACCESS SECURITY CONFIGURATION
# Generated via Moayyad Faris Security Tools
# ====================================================================

# 1. PROTECT WP-CONFIG.PHP DIRECT FILE ACCESS
<Files wp-config.php>
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</Files>

# 2. PROTECT SENSITIVE CONFIG, LOG & BACKUP FILES
<FilesMatch "(^#.*#|\.(bak|conf|dist|fla|in[ci]|log|psd|sh|sql|sw[op]|ini|env|phps)|~)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>

# 3. BLOCK XML-RPC BRUTE FORCE ATTACKS
<Files xmlrpc.php>
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</Files>

# 4. DISABLE DIRECTORY BROWSING & HIDE SERVER SIGNATURE
Options -Indexes
ServerSignature Off

# 5. BLOCK PHP EXECUTION IN WP-CONTENT/UPLOADS
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /
  RewriteRule ^wp-content/uploads/.*\.(php|phps|php5|php7|phtml)$ - [F,L]
</IfModule>

# 6. BLOCK USER AUTHOR ENUMERATION SCANS
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{REQUEST_URI} !^/wp-admin
  RewriteCond %{QUERY_STRING} (author=\d+) [NC]
  RewriteRule .* - [F,L]
</IfModule>

# 7. HTTP SECURITY HEADERS
<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=HTTPS
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header unset Server
  Header unset X-Powered-By
</IfModule>

# 8. GZIP COMPRESSION FOR FAST ASSETS
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript application/json image/svg+xml
</IfModule>

# ====================================================================
# STANDARD WORDPRESS REWRITE RULES
# ====================================================================
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
01

How to use

  1. Toggle desired security hardening options (protect wp-config, block XML-RPC, disable directory indexing, block PHP in uploads).
  2. Inspect the auto-generated production .htaccess file content.
  3. Copy or download the .htaccess file and upload it to your WordPress root web folder (/public_html/).
  4. Test your WordPress website to confirm all administrative functions remain operational.
02

Understanding the output

The generator creates modular Apache HTTPD `.htaccess` rewrite and access restriction directives designed specifically to shield WordPress core files (`wp-config.php`, `xmlrpc.php`), prevent brute-force login attempts, block malicious PHP uploads, and enforce security headers.

03

Common issues & tips

  • •Always create a backup copy of your existing `.htaccess` file before replacing it on production WordPress servers.
  • •If your server runs Nginx instead of Apache, `.htaccess` directives will be ignored. Use our Nginx Config Security Analyzer for Nginx server rules.

Frequently asked questions

Where do I upload the generated .htaccess file?
Upload it to your WordPress root web directory (usually /public_html/ or /www/) replacing or supplementing your existing .htaccess file.
Will blocking XML-RPC break my site?
xmlrpc.php is used by legacy mobile apps and Jetpack. If you do not use Jetpack or mobile publishing apps, disabling it eliminates a major brute-force attack vector.

Related tools

Security Header Analyzer

Check which security headers a site sends, with plain-language explanations.

Nginx Config Security Analyzer

Audit nginx.conf for security vulnerabilities, missing HSTS/CSP headers, and weak SSL protocols.