{"id":20219,"date":"2025-03-27T10:26:32","date_gmt":"2025-03-27T10:26:32","guid":{"rendered":"https:\/\/www.webhosting.uk.com\/kb\/?p=20219"},"modified":"2026-03-03T11:28:32","modified_gmt":"2026-03-03T11:28:32","slug":"how-to-improve-wordpress-security-with-htaccess-rules","status":"publish","type":"post","link":"https:\/\/www.webhosting.uk.com\/kb\/how-to-improve-wordpress-security-with-htaccess-rules\/","title":{"rendered":"How to Improve WordPress Security with .htaccess Rules"},"content":{"rendered":"

This guide explains how to improve WordPress security with .htaccess rules. WordPress is a popular CMS, but its popularity makes it a common target for hackers. You can strengthen and improve your WordPress website security by applying simple but effective .htaccess rules. These rules help protect core files, restrict unauthorised access, and reduce common vulnerabilities.<\/p>\n

What is the .htaccess File?<\/p>\n

The .htaccess file is a powerful Apache configuration file located in your website\u2019s root directory. It allows you to control various aspects of your website, including URL structure, redirections, and security rules.<\/p>\n

Important .htaccess Rules for WordPress Security<\/strong><\/p>\n

    \n
  1. Restrict Access to wp-config.php
    \nThe wp-config.php file contains your database credentials and other sensitive information.<\/p>\n
    <files wp-config.php>\r\norder allow,deny\r\ndeny from all\r\n<\/files><\/pre>\n<\/li>\n
  2. Block Access to .htaccess Itself
    \nPrevent attackers from viewing or editing your .htaccess file.<\/p>\n
    <files .htaccess>\r\norder allow,deny\r\ndeny from all\r\n<\/files><\/pre>\n<\/li>\n
  3. Protect wp-includes Directory
    \nThe wp-includes directory contains core files that should not be accessed directly.<\/p>\n
    <IfModule mod_rewrite.c>\r\nRewriteEngine On\r\nRewriteRule ^wp-includes\/ - [F,L]\r\n<\/IfModule><\/pre>\n<\/li>\n
  4. Disable Directory Browsing
    \nPrevent users from viewing the directory listing of your site.<\/p>\n
    Options -Indexes<\/pre>\n<\/li>\n
  5. Limit Access to the Admin Area by IP
    \nAllow only specific IP addresses to access the \/wp-admin area.<\/p>\n
    <Limit GET POST>\r\norder deny,allow\r\ndeny from all\r\nallow from YOUR_IP_ADDRESS\r\n<\/Limit><\/pre>\n
    Replace YOUR_IP_ADDRESS with your real IP.<\/li>\n
  6. Prevent Image Hotlinking
    \nBlock others from using your images on their sites and consuming your bandwidth.<\/p>\n
    RewriteEngine on\r\nRewriteCond %{HTTP_REFERER} !^$\r\nRewriteCond %{HTTP_REFERER} !^https:\/\/(www\\.)?yourdomain.com\/ [NC]\r\nRewriteRule \\.(jpg|jpeg|png|gif)$ - [F]<\/pre>\n<\/li>\n<\/ol>\n
    Tips:<\/p>\n