Published on March 19th, 2009

by Jean-Baptiste Jung. 243 Comments -

.htaccess, the file which control the Apache webserver, is very useful and allows you to do a lot of things. In this article, let’s see how .htaccess can help you with your WordPress blog, for both security,functionnality and usability.

Warning

When editing or modifying the .htaccess file of your WordPress blog, make sure to always have a backup that you can restore in case of something went wrong.

1 – Redirect WordPress RSS feeds to feedburner with .htaccess

Which blogger doesn’t use feedburner? Sure, feedburner is a very nice service, allowing you to know how many people suscribed to your rss feeds. The only problem is that you must edit your theme files to manually change the rss url. Happilly, there’s a nice hack, using .htaccess, which will make you save a lot of time!

Don’t forget to modify line 6 before applying this code!

# temp redirect wordpress content feeds to feedburner RewriteEngine on RewriteCond %{HTTP_USER_AGENT} !FeedBurner [NC] RewriteCond %{HTTP_USER_AGENT} !FeedValidator [NC] RewriteRule ^feed/?([_0-9a-z-]+)?/?$ http://feeds2.feedburner.com/catswhocode [R=302,NC,L]

By default, WordPress category permalinks are displayed that way:

http://www.catswhocode.com/blog/category/wordpress

As you can see, the category in the url is pretty useless. Here’s how to remove it:

First backup your .htaccess file. Then, open it and append the following line:

RewriteRule ^category/(.+)$ http://www.yourblog.com/$1 [R=301,L]

Once saved, your categories pages will be displayed like this:

http://www.catswhocode.com/blog/wordpress

3 – Using browser cache

A very good way to optimize your blog loading time is to force the use of the browser cache. This code will not improve your blog loading time directly, but it will save some work to the server by sending a 304 not modified status when the requested element haven’t been modified.

FileETag MTime Size ExpiresActive on ExpiresDefault "access plus 1 year"

4 – Compress static data

Do you know that it is possible to send compressed data to the visitors, which will be decompressed by the client? This code will definitely save you (and your visitor) bandwidth and reduce your pages weight.

AddOutputFilterByType DEFLATE text/html text/plain text/xml application/xml application/xhtml+xml text/javascript text/css application/x-javascript BrowserMatch ^Mozilla/4 gzip-only-text/html BrowserMatch ^Mozilla/4.0[678] no-gzip BrowserMatch bMSIE !no-gzip !gzip-only-text/html

5 – Redirect Day and name permalinks to /%postname%/

The first thing to do is to login to your WordPress admin, go to Settings → Permalinks and select custom. Fill out the field with /%postname%/.

Your permalinks will now look like the ones on this blog:

http://www.yourblog.com/name-of-the-post

Now we got to redirect all backlinks using the old permalinks structure to the new permalink structure. To do so, you’ll have to edit the .htaccess file, located in WordPress root directory.

Paste the following line in your .htaccess:

RedirectMatch 301 /([0-9]+)/([0-9]+)/([0-9]+)/(.*)$ http://www.domain.com/$4

Allright! You just changed your permalinks structure without loosing any backlinks!

6 – How to: Deny comment posting to no referrer requests

Are you sick and tired about the daily amount of spam comments received? Sure, there’s akismet, but here’s a little .htaccess trick to prevent spammers posting on your blog. The fact is that most spammers uses bots comming from nowhere. This code will look for the referrer (the page from where the commentator come from) and will deny commenting if the commentator try to access the wp-comments-post.php file without directly comming from your blog.

Just change the line 4 and specify your blog url there.

RewriteEngine On RewriteCond %{REQUEST_METHOD} POST RewriteCond %{REQUEST_URI} .wp-comments-post\.php* RewriteCond %{HTTP_REFERER} !.*yourblog.com.* [OR] RewriteCond %{HTTP_USER_AGENT} ^$ RewriteRule (.*) ^http://%{REMOTE_ADDR}/$ [R=301,L]

7 – Redirect visitors to a maintenance page

When you’re upgrading your blog, or making theme/design changes, it isn’t a good idea to let people see your blog being tweaked, sometimes with design or code problems, or even worst, security gaps.

The solution is to design a nice “maintenance page” and temporarily redirect your visitors to that page until you finished the maintenance.

Replace maintenance.html (line 2) by the page you’d like to redirect your visitors, and the IP adress on line 3 by your own ip.

Note that a 302 redirection is used, to avoid search engines indexing the maintenance page instead of your real homepage!

RewriteEngine on RewriteCond %{REQUEST_URI} !/maintenance.html$ RewriteCond %{REMOTE_ADDR} !^123\.123\.123\.123 RewriteRule $ /maintenance.html [R=302,L]

8 – Protect your WordPress blog from hotlinking

Hotlinking is the use of an image from one site into a web page belonging to another site. Many bloggers are hotlinked, and have their bandwidth used on another websites. This very helpful code will protect your WordPress blog from hotlinking.

RewriteEngine On #Replace ?mysite\.com/ with your blog url RewriteCond %{HTTP_REFERER} !^http://(.+\.)?mysite\.com/ [NC] RewriteCond %{HTTP_REFERER} !^$ #Replace /images/nohotlink.jpg with your "don't hotlink" image url RewriteRule .*\.(jpe?g|gif|bmp|png)$ /images/nohotlink.jpg [L]

9 – Allow only your IP adress on the wp-admin directory

Excepted the case of a collaborative blog, only you should be allowed to visit the wp-admin directory. If you have a static IP, this code will do the job.

All you have to do is to enter your static IP adress on line 8. Note that you can add more IPs if needed, by creating a new line with: allow from xx.xx.xxx.xx inside.

AuthUserFile /dev/null AuthGroupFile /dev/null AuthName "Example Access Control" AuthType Basic order allow, deny deny from all allow from xx.xx.xx.xx

10 – Banning a WordPress Spammer With .htaccess

You know it, spam is very annoying. In the case of a particular person/bot spamming you, you can easily avoid it by blacklisting the IP.

Simply replace the IP adress on line 3 by the spammer’s IP. You can add more spammers by creating a new line with deny from xxx.xx.xxx.xxx inside.

order allow,deny deny from 200.49.176.139 allow from all

8 – Protect your WordPress blog from hotlinking

It will be necessary to try necessarily, and that in manual each time to change names of files tires, at the same time and protection against theft of a content.

Thanks for the information

10 Great Ways to add custom settings to WordPress and make it more useful, and more secure!…

Already saved in my bookmarks, thanks a lot !

Just a question for #2 : deleting “category” could be negative for SEO or not ?

Hi,

Thanks for this article, it’s going to be really useful for me, in fact – essential! I’ve dugg this article.

In response to Comment #7, plugins are bloat. I’d prefer not to use plugins if possible.

1) refuse foreign references, as this solution does

2) redirect to offensive image to hasten the takedown (immature, funny, but without goatcxe, lacking “oomph”)

3) redirect to an advertisement for our site

I opted for #3, I redirected to a lighter-weight image of the site to bring in more clicks. Also, considered swapping out my own reference to that image (only one local ref) and making a permanent redirect for the original reference, with the idea that the discussion plus the 301-redirect to my content actually improves SEO around that subject — the foreign hotlink costs me less bandwidth, but brings in traffic and SEO ranking

I will have to remember that little tip! Thanks.

In this article, let’s see how .htaccess can help you with your WordPress blog, for both security,functionnality and usability….

thanks again…

I’ve always been sorta scared to touvh the htaccess file, but I realized its fine. Just to back it up.

Anyway, nice post, I like the one with feedburner, probably the most popular one.

superb post!! bookmarked and tweeted

But I particularly don’t like the first hack. it defeats the purpose of feed structure of WordPress.

awesome!

i found in my htacess old code and remove this… and now is my blog faster then before. Thx for this article!

通过 Apache çš„ .htaccess 实现：重定向 Feed 地址，去除分类链接中的 /category/，浏览器缓存，压缩静态数据，重定向日期格式的链接地址为 postname 格式，阻止没有 referrer 来源链接的垃圾评论，定….

@ Allan i think i am going to do the same thing and show an ad for my site.

Great list of tips and tricks i am defiantly going to implement a few of them.

Nice collection of tips. Still, have you tried #4 yourself? It seems not to work (checked with YSlow), components still aren’t gziped.

As for #6, unfortunately, it’s really easy to set the referrer and user agent, from any server-side script, loads of bots are that advanced. Did you notice any improvement with it?

.htaccess, the file which control the Apache webserver, is very useful and allows you to do a lot of things. In this article, let’s see how .htaccess can help you with your WordPress blog, for both security,functionnality and usability….

@ Maigret – removing category won’t matter unless you want to rank for that word

Re #3 – is this required if you’re using the WP Super Cache plugin? It seems to do client side caching as well as server side. Not sure though.

Stumbled your article. Thanks.

Super Article!

On our site we have comments turned off, however in a dashboard you can still see the huge list of spams trying to get in via wp-comments-form.php and mostly from auto insurance sites, since we’re in that business. Hopefully we put the stop on that.

Thank you so much, I already add the lines to my .httacess,

Yeah but why would you ever want to use a plugin when there is no need.

Plugins increase load time of your site and also pose possible security issues to your blog. Last week, someone tried to hack our blog using a security hole in the wp-adverts plugin. We don’t use that plugin, however.

Whenever you can do something without a plugin, especially if it’s through .htaccess, that’s the way to do it.

Excellent collection, already tweeted/sent this to everyone I know.

Re: 2) there is some value to your categories being identified as such to Google, same for Tags if you use them (which I hope you do, ideally with SimpleTags plugin which rules over WordPress’ native tag handling).

Re: 5) nice trick, of course one should set this up in the way you describe from the beginning…

Re: 6) I’ve found the YAWASP Plugin to catch 99% of spam via a very simple yet genius method that doesn’t require captchas and doesn’t have the overreach problems that Akismet has (I have Akismet turned off in fact).

many thanks to you

RewriteCond %{REQUEST_URI} !/maintenance.html$

Is this correct?

RewriteCond %{REQUEST_URI} !abc.com$

Mezanul

Just remember though, if you stop hotlinking to images on your site you may be denying people a way to find your site. I get traffic from people searching Google and Yahoo Images.

Toronto Plastic Surgeon

See my previous comment. Plugins can slow down the load time of your blog and also provide possible security holes. I’ve been on the WP forums for awhile and there are a number of people’s blogs which have been hacked due to security issues with some plugins.

.htaccess is always the best way to do things. It’s read before your website is even visited.

You can also answer me on niazi587 at gmail dot come

RewriteRule ^category/(.+)$ http://www.yourblog.com/$1 [R=301,L] on my blog.

It works, but when you get to any categories, it won’t let me access pages, like /page/2/ without getting a 404 error.

It appears that I need something to handle the pages.Any suggestion how to handle the following, /page/*/

Finally a clear article about htaccess tips !

2 questions though : is there an easy way to set up a password at the homepage (and the whole blog) ?

My default htaccess is like this :

# BEGIN WordPress

RewriteEngine On

# END WordPress

Where should I insert the code you provide ? Anywhere between the two “#” tags?

Emal

You can put it above as the very first item (above the first #) or below the last #, either way will work.

All the # are, are comments.

If you’re not familiar with .htaccess, then the easiest way to password protect either a directory or your entire site (i.e. password protect your root) is to set up password protection through your web hosting control panel. Log into your control panel and look for an icon or something name “Password Protect”.

awesome tips, thanks a lot.

you can do the same thing with categories in the permalink sections by using “/.” but it does throw out ome issues with pagination (does the htaccess change work with pagination?)

protecting from hotlinking images is really great.

great post!

Nice blog too, keep up the good work.

Hi,

Previously I was using a plugin called “Top Level Cats” to remove “category” from url. When I tried to upgrade WP to the latest version, that plugin started giving problem.

Thanks to your tip, I have now upgraded to WP 2.7.1 and everything is working perfect. Thank you so much.

Error: Critical Error

Hey Jean-Baptiste,

Just want to say thank you. My stuff drove me nuts with .htaccess. Please keep it up.

Once again thanks,

Thanks again,

only facing one problem after using couple steps in here.

all my urls ending with (.htm) is there is any htaccess rule/tip to remove that and just get clean url?

thanks again

hi

i need your help i am new to wordpress my questions are

1. is it possible to publish the posts in different directories like if i post it shows

“www.example.com/your-post” i want to publish the post like “www.example.com/computers/your-post”

and “www.example.com/internet/your-post”

2. i install wordpress and i change the permalink settings from “default” to “month and name” and after saving it says “You should update your .htaccess now” but i don’t know where it is and what to update in it.

i have publish no any posts

Please help

hi..

i am new to wp. if i want to use all the .htaccess hacks, can anyone show me how to write all the .htaccess hacks in just one .htaccess file?

I really dont know about .htaccess file, but thanks for posting.

@ sikiÅŸ – The easiest way to do that if you’re not familiar with .htaccess rules is to simply set up a password protection system through your web hosting control panel.

Most all hosting companies provide this service. Just a few clicks and you can password protect any directory, including your root.

hi..

i am new to wp. if i want to use all the .htaccess hacks, can anyone show me how to write all the .htaccess hacks in just one .htaccess file?

…link rel=”stylesheet” href=”http://mydomain.com/wp-content/themes/xmnt/style.css” type=…

to

…link rel=”stylesheet” href=”/xmnt/style.css” type=…

I want to hide the root address…Can .htaccess execute like that?

If can, can You give me some example how to do it. tnx

I want to hide the root address…Can .htaccess execute like that?

If can, can You give me some example how to do it. tnx

I am having problem with WP blog, after upgrade to IE8

The posts/pages can only opened if the permalinks are set in default.

Others, will show “The webpage cannot be found” HTTP404

How to solve? Please

Good day,

I’m new to WordPress and I’m trying to add permalinks so my posts are searchable. Problem – I can’t find .htaccess to open and edit it as per wp-admin instructions. If I try and create a new file .htaccess it tells me it is already there. Is it hidden? It’s probably simple but something is escaping me!!! HELP!

When I insert this code to zen-cart .htaccess:

redirect 301 /odd.html http://www.odddomain.com/new.html

it did redirect to the new.html, but zencart add certain parameters to the end of the new url which resulted in the show up of the odd.html content while the url is new.html.

Please help, thanks.

Order Allow,Deny

Deny from all

Allow from all

allow from xx.xx.xx.xx

This way when users login they do just see a plain jain ugly page and they get the css loog of the wordpress login.

@Alan Clark: Like your developed suggestion for #8 hotlinking.

but thanks for the tip on HACK #9

Currently permalink: /%year%/%monthnum%/%postname%.html

Future permalink: /%postname%

if visitor come without reff then go ban it

if user agent come then ban go ban it

but if visitor or user agent comes withboth of two list ( the reff and/real user agents name )its must 200

sorry im still newb ^^ i want to learn please let me know how to to this

but if i got thats way i will tell you too

Social comments and analytics for this post…

This post was mentioned on Twitter by alaksir: Useful reference for you web geeks: 10 awesome .htaccess hacks for WordPress http://bit.ly/1V9pNY…

Wow impressive article!

Recently, I’ve created a new subdomain (the domain has a wordpress blog on it) and I’ve uploaded some avi files there. I’ve created then an html file with links pointing to these movies.

The problem is I cannot access these files when I click on the links. Is giving me that message with “Nothing found for …”.

I guess is related to .htaccess file or / and somehow to wordpress since I did the same thing on another domain with no worpdress on it and it works. Any ideas why this problem?

I try my self with trick number 3 & 4..

Now my blog load like dedicated sever!

RewriteRule ^category/(.+)$ http://www.yourblog.com/$1 [R=301,L]

I tried this but it does not work:

Any help would be highly apreciated.

Hi,

I need some help with my permalinks – actually I’ve decided to change them from /%category%/%postname%/ to /%year%/%monthnum%/%category%/%postname%/

Could you please tell me how to 301 redirect them.

Thanks in advance!

Having always found .htaccess files a bit of a black art (but more obscure), this post contains some really great tips that I will be trying out soon.

I especially like the ones to do with blocking spammers, as some of our blogs get a ton of comment spam (which Akismet picks up, for the most part, fortunately).

I also love the idea of replacing hot-linked banners with adverts for your own site. Brilliant!

This is great tips. Thank you for sharing with us. Especially point no 5, it’s really help me with permalink.

Just want to share that if anybody experiencing a problem with “404 error not found” in google webmaster tool, right now there is a plugin that can fix it. Just search in the plugin area and you will have a lot of plugin regarding redirecting no need to modified your ht.access anymore.

Cheers!

Reply

sara

said:

Help please?

Redirect Day and name permalinks to /%postname%/

Your code is the only one that has worked for me from the other methods I’ve been trying in the past hour. Thanks heaps!

Name

Website

Comment

Please respect the following rules: No advertising, no spam, no keyword in name field. Thank you!