htaccess Generator

The .htaccess file lets you tell your server how to behave, without touching any server settings. Block a visitor, stop other sites stealing your images, hide files nobody should reach, make repeat visits faster.

Pick a job from the tabs, fill in anything it asks for, and copy the block.

Read this before you paste anything

Three rules. Every one of them has ruined somebody’s evening.

Download the file first

A single wrong character in .htaccess takes your entire website down with a 500 error. Not one page. All of it, including the admin area, so you cannot log in to fix it.

The fix is to put the old file back, which takes seconds if you have it and is a nightmare if you do not. Download a copy before you change anything.

Paste above # BEGIN WordPress

Open the file and you will see a block that starts with # BEGIN WordPress. Your rules go above it.

Options -Indexes

# BEGIN WordPress
# ... WordPress owns everything below this line

Two reasons. WordPress rewrites its own block whenever you change permalink settings, and anything you put inside it gets wiped. And its rules end with a stop instruction, so some rules placed after it are never read at all.

Where the file lives

In your hosting File Manager, inside public_html, next to wp-config.php. The name starts with a dot, which means hidden, so you may need to turn on “show hidden files” in the file manager settings before it appears.

If there is no .htaccess at all, create one. That is normal on a fresh site.

One thing worth knowing up front: none of this works on Nginx, which ignores .htaccess completely. Most shared hosting is Apache or LiteSpeed, which both work fine. If nothing at all happens after following every step, that is usually why.

What each job does

Block an IP

Stops specific addresses reaching your site at all. They get a blank “Forbidden” page.

Genuinely useful against one persistent comment spammer or someone hammering your login page from a single address. Much less useful against a real attack, which will come from thousands of addresses at once. For that you want a security plugin or Cloudflare.

You can block a whole range by adding a slash and a number, like 198.51.100.0/24, which covers 256 addresses. Be careful with that. Ranges are shared, and blocking a big one can block real customers who happen to use the same provider.

The important bit: almost every guide online still shows Order Deny,Allow for this. That syntax was removed in Apache 2.4, released in 2012. On a modern server it causes a 500 error rather than blocking anything. The tool uses the current Require syntax instead.

Stop hotlinking

Hotlinking is when another website displays your image by linking straight to the file on your server. Their page, your bandwidth. On a busy thief it adds up to a real hosting bill.

This rule checks where the request came from. If a page on another site asked for the image, the server refuses. Your own pages carry on normally.

Leave the tick box on. It allows requests with no referrer at all. Turn it off and your images break when someone opens one directly in a tab, and also for visitors using privacy tools that strip that information. That is a lot of broken images to save a little bandwidth.

One thing to think about first: hotlinking from social networks and Google Images is often how people find you. Blocking everything can quietly cost you traffic.

Hide sensitive files

The one to add to every site, today, whatever else you do.

It blocks direct access to configuration files and, more importantly, to the leftovers. When you edit wp-config.php in a file manager, many of them quietly save a copy as wp-config.php.bak. That copy is not PHP any more, so the server does not run it, it just hands it over as plain text. Your database password included.

People scan for exactly these filenames all day long. This rule covers .bak, .old, .orig, .save, .swp, .sql and .log, plus the config files themselves.

It deliberately leaves .well-known alone, because SSL certificate renewal needs that folder. Block it and your certificate stops renewing, which breaks the site in a few months in a way nobody connects back to this change.

Turn off folder listing

Without this, opening a folder that has no index file shows a browsable list of everything inside it.

That is how people find your uploads folder, old backups, and files you put somewhere temporarily two years ago and forgot. One line fixes it.

Most hosts disable this by default now. Add it anyway. It costs nothing, and hosts change their defaults.

Custom error pages

Sends visitors to your own page instead of the bare server error message.

On WordPress this matters less than you might think, because your theme already handles 404s for anything WordPress sees. It matters for the errors WordPress never gets to handle, like a missing image or a request blocked by one of the rules above.

Use a path, not a full web address. Write /404/, not https://yoursite.com/404/. With a full address Apache sends a redirect first, which turns what should be a clean 404 into a page search engines read as working. That is how deleted pages stay in Google forever.

Browser caching

Tells browsers to keep a copy of your images, stylesheets and fonts. A returning visitor reuses what is already on their machine instead of downloading it again, which makes the second visit noticeably faster.

It also removes one of the warnings that page speed tools like to shout about.

The catch. A one year cache means exactly that. Replace a logo with a file of the same name and returning visitors keep seeing the old one, possibly for months. WordPress adds a version number to its own files so they update properly, but images you swap by hand do not get that.

The habit that avoids it: when you replace an image, upload it under a new name.

If you already run a caching plugin like WP Rocket or LiteSpeed Cache, it has almost certainly done this for you. Adding it twice does no harm but achieves nothing.

Block bad bots

Turns away crawlers that exist to scrape your content or map your site for competitors. SEO crawlers like Ahrefs and Semrush, plus various scrapers that ignore robots.txt.

On a small site this can noticeably cut server load, because those crawlers are relentless and none of them send you a single visitor.

Two honest warnings.

First, this checks the name a bot reports about itself, which any determined one simply changes. It stops the lazy majority. It is not a defence against anyone serious.

Second, blocking Ahrefs and Semrush also means your own site stops appearing properly in those tools, including for you. If you or an SEO you work with uses them, leave those two off the list.

Never add Googlebot or Bingbot. That would remove you from search entirely.

Something broke

The whole site shows a 500 error

Put back the copy you downloaded. The site returns immediately.

Did not download one? Rename .htaccess to .htaccess-broken in your file manager. The site comes back, though your permalinks will break until you go to Settings then Permalinks in wp-admin and click Save, which rebuilds the WordPress part.

The usual cause is a directive your server does not support. Add rules one at a time rather than all at once, and you will know immediately which one it was.

Nothing happened at all

Either the file is in the wrong folder, or your host runs Nginx, which ignores .htaccess entirely. Ask your host’s support chat which one you are on. It is a one line answer for them.

My images disappeared everywhere

The hotlink rule, and the domain in it does not match how your site is actually served. If your site loads as www.example.com but the rule was built for example.com, every request looks like it came from somewhere else. Regenerate it with the address that actually appears in your browser bar.

I locked myself out

Blocked your own IP address by mistake. You cannot undo it from the browser, so use the file manager in your hosting control panel, which does not go through the site at all, and delete the block.

Related tools

Two other jobs use the same file and have their own pages, because both need more than a snippet.

• Redirect generator for sending an old address to a new one, whether that is one page, a whole folder, or a whole domain.
• htpasswd generator for putting a password on a folder, which needs a second file alongside the .htaccess rules.