Many WordPress users come across .htaccess file when fixing their permalinks. However you can do so much more. The .htaccess file is a powerful configuration file that allows you to improve your site’s security and performance. In this article, we will show you 9 most useful .htaccess tricks for WordPress that you can try on your site right away.
The .htaccess code in this post is designed to work when placed in the web-accessible root .htaccess file of your domain. Before making any changes to this file, make a good backup and keep it on hand just in case. Working with .htaccess is nothing to be afraid of, but it's critical to not make any mistakes in syntax, spelling, or anything that's not a comment (#). If you forget a dot working with CSS, your design might look messed up. If you forget a dot working with .htaccess your server will return a 500 – Internal Server Error. If this happens, don't panic, just upload your backup and everything will be fine.
1. Protect Your WordPress Admin Area
You can use .htaccess to protect your WordPress admin area by limiting the access to selected IP addresses only. Simply copy and paste this code into your .htaccess file:
01
AuthUserFile /dev/null
02
AuthGroupFile /dev/null
03
AuthName "WordPress Admin Access Control"
04
AuthType Basic
05
<LIMIT GET>
06
order deny,allow
07
deny from all
08
# whitelist Syed's IP address
09
allow from xx.xx.xx.xxx
10
# whitelist David's IP address
11
allow from xx.xx.xx.xxx
12
# whitelist Amanda's IP address
13
allow from xx.xx.xx.xxx
14
# whitelist Muhammad's IP address
15
allow from xx.xx.xx.xxx
16
# whitelist Work IP address
17
allow from xx.xx.xx.xxx
18
</LIMIT>
Replace xx.xx.xx.xxx with your own IP addresses. If you use more than one IP address to access the internet, then make sure you add them as well. See our guide on how to protect your admin folder in WordPress using .htaccess
2. Additional Security Login Layer for wp-admin Login
Most often, when you want to go to WordPress dashboard, you would type in youdomain.com/wp-admin, and there is login page, you can login.
To harden the login page, you can setup an additionally Security login layer, so when you go to youdomain.com/wp-admin, a pop up login Window appears, and once you have entered the login information correctly, you will be forwarded to the default WordPress login page.
It sounds troublesome to login, but it can improve your website’s security.
1) create .htpasswd file by going to htaccesstools.com/htpasswd-generator/ and generate username and password
2) upload .htpasswd file to your WordPress wp-admin folder
3) add the following code to your .htaccess file
ErrorDocument 401 default
AuthType Basic
AuthName "Restricted Area"
AuthUserFile /home/public_html/wp-admin/.htpasswd
require valid-user
3. Canonical robots.txt
Help bots and visitors find your robots.txt file no matter what. Given that the robots.txt file should always be located in the root directory, you would think that this wouldn't be an issue. Unfortunately, bad bots and malicious scripts like to scan for robots.txt files everywhere. Fortunately, this .htaccess snippet eliminates the nonsense by directing any request for "robots.txt" to the actual file in your root directory. If you're sick of seeing endless requests for nonexistent robots files, this code's for you:
# CANONICAL ROBOTS.TXT
<IfModule mod_rewrite.c>
RewriteBase /
RewriteCond %{REQUEST_URI} !^/robots.txt$ [NC]
RewriteCond %{REQUEST_URI} robots\.txt [NC]
RewriteRule .* http://example.com/robots.txt [R=301,L]
</IfModule>
4. Canonical Favicons
Avatars, gravatars, and favicons are a big hit with malicious scanners. Evil scripts like to traverse your directory structure with requests for commonly used images such as the ubiquitous favicon.ico. So just as with robots.txt, we can stop the madness and redirect any request for "favicon.ico" to the actual file in your root directory.
# CANONICAL FAVICONS
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_URI} !^/favicon.ico$ [NC]
RewriteCond %{REQUEST_URI} /favicon(s)?\.?(gif|ico|jpe?g?|png)?$ [NC]
RewriteRule (.*) http://example.com/favicon.ico [R=301,L]
</IfModule>
5. Disable Directory Browsing in WordPress
Many WordPress security experts recommend disabling directory browsing. With directory browsing enabled, hackers can look into your site’s directory and file structure to find a vulnerable file. Learn more about why and how to disable directory browsing in WordPress.