.htaccess Tips for WordPress Sites

The .htaccess file lets the server filter requests before they reach WordPress. With the rules below you can protect sensitive files and block common attacks.

Editing the .htaccess file

1. Log in to your Plesk panel at https://yourdomain.com:8443 or from the service page in your client area.
2. Open the httpdocs folder from the Files menu.
3. Click the .htaccess file and choose Edit in Text Editor. If you cannot see the file in your FTP client, turn on showing hidden files.
4. Add the rules you need from below, save, and check your site.

1. Block access to sensitive files

wp-config.php contains your database password. Stop it and .htaccess from being read in a browser:

# Block outside access to wp-config.php and .htaccess
<Files wp-config.php>
  Require all denied
</Files>
<Files .htaccess>
  Require all denied
</Files>

2. Turn off directory listing

Stops the contents of your folders and the plugins you use from being listed:

# Turn off directory listing
Options -Indexes

3. Block PHP execution in the uploads folder

A common attack is uploading a malicious PHP file to wp-content/uploads and running it. Add the code below only to a new .htaccess file you create inside the wp-content/uploads/ folder:

# Do not run PHP files in this folder
<FilesMatch "\.(php|phtml|phar)$">
  Require all denied
</FilesMatch>

4. Turn off XML-RPC

If you do not use Jetpack or the WordPress mobile app, turn off XML-RPC, which is often used in brute force attacks:

# Turn off XML-RPC
<Files xmlrpc.php>
  Require all denied
</Files>

5. Block username scans

Attackers try to find your administrator username with the ?author=1 query:

# Block username scans via ?author=1
RewriteEngine On
RewriteCond %{QUERY_STRING} (^|&)author=\d+ [NC]
RewriteRule .* - [F,L]

6. Add security headers

These stop your site from being loaded in a frame on other sites and prevent attacks based on file type confusion. You can check whether your site already sends these headers at securityheaders.com; if it does, do not add them again.

<IfModule mod_headers.c>
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

If something goes wrong

500 Internal Server Error

The last rule you added has a typo. Remove the last section you added or restore your backup.

A plugin stopped working

Turning off XML-RPC or the uploads rule can affect some plugins. Remove the rule in question and try again.

The same rule was added twice

Plugins such as Wordfence or Solid Security also write rules to .htaccess. Do not add the same rule a second time.

The .htaccess file is for Linux hosting (Apache). On Windows hosting these settings are made in the web.config file; open a support ticket if you need help.