Question 1

What is .htaccess and what does it control in WordPress?

Accepted Answer

.htaccess is an Apache web server configuration file that controls how the server processes requests for a specific directory and all its subdirectories. In WordPress, it primarily handles: (1) Pretty permalinks — the default WordPress rewrite rules that route /post-name/ to index.php; (2) Security — blocking access to sensitive files like wp-config.php and xmlrpc.php; (3) Performance — enabling GZIP compression and browser caching headers; (4) Redirects — 301 redirects for migrated URLs or HTTPS enforcement. Changes to .htaccess take effect immediately without server restart.

Question 2

Should I block xmlrpc.php in WordPress?

Accepted Answer

Yes, in most cases. xmlrpc.php is a legacy remote publishing API that enables brute force attacks (attackers can try thousands of password combinations in a single request due to multicall), and amplification DDoS attacks against other sites. Most WordPress sites don't need xmlrpc.php unless they use: the Jetpack plugin (uses XML-RPC for some features), mobile WordPress apps (older versions), or third-party services that specifically require it. If you use none of these, blocking it in .htaccess eliminates a significant attack vector.

Question 3

How do I enable GZIP compression in WordPress .htaccess?

Accepted Answer

GZIP compression is enabled in .htaccess using the mod_deflate Apache module. Key directives: AddOutputFilterByType DEFLATE text/html text/css application/javascript text/xml application/xml application/json. GZIP typically reduces HTML file size by 70–85%, CSS by 75–90%, and JavaScript by 65–80%. This dramatically reduces time to first byte and page load times. Verify GZIP is working after deployment using a GZIP checker tool or browser DevTools (look for 'Content-Encoding: gzip' in response headers).

Question 4

What browser caching rules should I add to WordPress .htaccess?

Accepted Answer

Browser caching via .htaccess uses the mod_expires module. Recommended cache durations: images (JPG, PNG, GIF, WebP, SVG) — 1 year (they're typically fingerprinted/versioned by WordPress); CSS and JavaScript — 1 year (WordPress appends ?ver= query strings for cache busting); fonts — 1 year; HTML — 0 seconds or max-age=300 (5 minutes) to ensure fresh content. Also add Cache-Control: must-revalidate for HTML. Caching plugin (WP Rocket, W3 Total Cache) or CDN (Cloudflare) will handle this more comprehensively than .htaccess alone.

.htaccess Generator

Rules you can include

Block xmlrpc.php

Protect wp-config.php

GZIP compression

Browser caching

Block author enumeration

Protect uploads from PHP

Frequently asked questions

Related WordPress tools

Harden your server in one download