Tutorial - Using the htaccess file with WordPress

Objective

This tutorial will show you how to configure certain features of your web hosting plan with one or more .htaccess files, namely to modify settings for part or all of your website (redirections, access bans, restricted permissions, cache control, etc.).

This tutorial explains how to secure your WordPress with one or more .htaccess files.

Requirements

• An OVHcloud web hosting plan with WordPress installed.
• Using an FTP client such as FileZilla, as explicated in our FileZilla tutorial”.

.htaccess files can be created and modified with text editors, for example:

• Notepad on Windows
• TextEdit on macOS
• Notepad++.

FAQ

What is a .htaccess file?

You can use a .htaccess file to configure a web server. For web hosting plans, this is the open source web server Apache. The syntax of this file is defined by the organisation that develops and maintains Apache. Unlike most configuration files on a server, .htaccess files are located in the directories of websites, more precisely in the FTP storage space of your web hosting plan. A .htaccess file will affect the directory in which it is located and all its subdirectories.

Our web hosting plans do not allow server configuration files. However, .htaccess files provide the ability to modify certain characteristics and behaviours. In addition, you do not need to reboot the Apache server for the instructions and modifications written to the .htaccess file to be applied. All of our OVHcloud web hosting offers allow you to configure .htaccess files.

The dot in front of the file name .htaccess (which itself does not have an extension) denotes a hidden file. Furthermore, these files are not accessible by external users visiting your website.

What is a web server?

A web server is software that enables information to be exchanged over a network using the Hypertext Transfer Protocol (HTTP).
There are several, including Apache, Nginx, Tomcat or the http module included in NodeJS.

What precautions should be taken?

An incorrect configuration of your .htaccess file may generate errors on your server (such as a 500 error: Internal Server Error), and make your service totally unavailable, even for you. Get in the habit of making systematic backups of the versions of your functional files, so that you can return to an earlier state in the event of an anomaly following a modification.

Similarly, if you are not used to working with this type of file, try each item you edit. This way, you will not have to waste time to find the line(s) that are causing your web server to stop working. A configuration error or a simple typo can compromise your web server’s configuration and therefore its operation.

Which tools to use?

• An FTP client to transfer your files (FileZilla, Cyberduck)
• A text editor

Where are the .htaccess files located in WordPress?

As mentioned in the introduction, you can have several .htaccess files on a single web hosting plan. Each of these files defines the rules for the directory where it is located, as well as the subdirectories of this parent folder.

The majority of modifications will be made to the root of the website. The .htaccess file at the root of the website, installed by default, contains the following lines:

# BEGIN WordPress
# The directives (lines) between “BEGIN WordPress” and “END WordPress” are generated
# dynamically, and must be modified only through WordPress filters.
# Any changes to directives between these markers will be overwritten.

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

Explanations of the above code:

• #: Character used to indicate a comment line.
• RewriteEngine On: Enables the Apache mod_rewrite module, which allows URL rewriting on the fly (also allows you to redirect a URL to another URL).
• RewriteRule: This syntax is written using the RewriteRule Template Substitution schema. The script can appear several times in the .htaccess file. (This is the case in the default file that you find at the root of your WordPress installation.) The order in which you write to the file is important. Be careful about the order in which you write your rules.
• RewriteBase: Indicates that the root of the site is /.
• RewriteCond: These are preconditions for the rule that follows directly. In our case, the first precondition excludes URLs containing a path to an actual file, while the second precondition excludes subdirectories.

What can I add to a .htaccess file with WordPress?

There are several ways to modify the settings that will change the server's behaviour (although there are some limitations depending on the hosting):

• Edit your server’s configuration files
• Add or edit directives in the wp-config.php configuration file in the root directory of your website
• Modify or add directives in the .htaccess file at the root directory

Instructions

Prevent the display of directories and subdirectories

To prevent your website visitors from viewing the contents of subdirectories (and incidentally give information to hackers about the themes or extensions used), block the visualisation of the content by adding this line to your .htaccess file:

Options All -Indexes

Protect your configuration file

Your wp-config.php file, located at the root of your website, contains sensitive configuration information. Block access to this file by adding the following lines to your .htaccess file:

<Files wp-config.php>
    order allow,deny
    deny from all
    satisfy all
</Files>

Block an IP address

If you have identified a malicious IP address, enter the following line in your .htaccess file:

<Limit GET POST>
  order allow,deny 
  deny from 203.0.113.0
  allow from all
</Limit>

<Limit GET POST>
  order allow,deny 
  deny from 2001:db8:1:1b00:203:0:113:0
  allow from all
</Limit>

For more information on this subject, please refer to our guide on IP access restriction via the .htaccess file.

Block access to the wp-admin directory (or other directories) by IP

The wp-admin directory is used to access your administration interface. (The method also works with other directories whose URLs do not lead to an administrative interface.) To protect this directory, restrict access to one or more IP addresses using the following code to place in your .htaccess:

<Limit GET POST PUT>
  order deny,allow 
  deny from all
  allow from 203.0.113.0
  allow from 203.0.113.1
</Limit>

<Limit GET POST PUT>
  order deny,allow 
  deny from all
  allow from 2001:db8:1:1b00:203:0:113:0
  allow from 2001:db8:1:1b00:203:0:113:1
</Limit>

Important information to remember

• Save a working version of your .htaccess file before you make any changes.
• If the modifications you have made cause an error, replace (via your FTP client) the online .htaccess file with the previous version.
• You can manage some settings in your wp-config.php file.
• .htaccess files are particularly effective for URL management, redirections and website security.

Go further

Official Apache .htaccess tutorial.

For specialised services (SEO, development, etc.), contact OVHcloud partners.

If you would like assistance using and configuring your OVHcloud solutions, please refer to our support offers.

Join our community of users.