he .htaccess file is an important configuration file for WordPress websites running on Apache web servers. It helps WordPress handle clean URLs, commonly known as permalinks, and allows certain server-level behaviors to be configured without directly editing the main Apache configuration.
If you have installed WordPress on shared hosting or cPanel, you may have encountered this file in your website’s root directory. You might also need to restore it if your website suddenly displays 404 errors, your permalinks stop working, or a plugin modifies the file incorrectly.
In this guide, you will learn what the default WordPress .htaccess file looks like, how its rewrite rules work, how to restore the configuration, and what to check when something goes wrong.
What Is the WordPress .htaccess File?
The .htaccess file is a per-directory configuration file used by the Apache HTTP Server. It allows supported configuration directives to be applied to a directory and its subdirectories without changing the server’s main configuration file.
WordPress commonly uses .htaccess to implement pretty permalinks. Instead of displaying URLs such as:
You can use a cleaner URL, such as:
When a visitor requests a URL that does not correspond to an existing file or directory, Apache can rewrite the request to WordPress’s index.php. WordPress then determines which post, page, archive, or other content should be displayed.
The exact behavior depends on your permalink settings and server configuration.
What Is the Default WordPress .htaccess Code?
For a standard WordPress installation in the root directory of an Apache website, the following is a common default configuration for pretty permalinks.
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPressThis configuration is intended for a typical root-level installation using Apache’s mod_rewrite module. Your exact rules may differ depending on your WordPress setup, permalink structure, hosting environment, or plugins.
Important: This configuration is for Apache. Nginx does not read .htaccess files, so equivalent URL-rewriting rules must be configured in the Nginx server configuration.
Understanding Each WordPress Rewrite Rule
Let’s break down the configuration to understand what each directive does.
1. BEGIN and END WordPress
# BEGIN WordPress
...
# END WordPressThese comments mark the section managed by WordPress. WordPress may update the rules inside this section when permalink settings are saved.
If you need to add custom directives, keep them outside the managed section unless the instructions for a particular plugin or configuration explicitly require otherwise. Custom rules can otherwise be overwritten when WordPress regenerates its rewrite configuration.
2. Check Whether mod_rewrite Is Available
<IfModule mod_rewrite.c>This directive tells Apache to process the enclosed directives only when the mod_rewrite module is available.
The module provides URL-rewriting functionality that WordPress uses to support pretty permalinks.
The closing </IfModule> marks the end of this conditional block.
3. Enable the Rewrite Engine
RewriteEngine OnThis enables the rewrite engine for the current directory context.
Without rewrite processing, the rules that follow cannot perform the URL rewriting required by this configuration.
4. Pass the HTTP Authorization Header
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]This rule passes the incoming Authorization header into an environment variable named HTTP_AUTHORIZATION.
Some authentication integrations, plugins, and API-related workflows rely on access to this header. Keeping the rule can help maintain compatibility with software that expects it.
5. Set the Rewrite Base
RewriteBase /This specifies the base URL path used when Apache resolves relative rewrite substitutions.
In this example, / represents the website’s root path. A WordPress installation in a subdirectory may require a different configuration, so do not copy this setting blindly into every installation.
6. Exclude index.php from Rewriting
RewriteRule ^index\.php$ - [L]This rule matches index.php and prevents it from being processed by subsequent rewrite rules in the current ruleset.
The ^ and $ characters mark the beginning and end of the matching pattern, while \. matches the literal dot in the filename.
The - substitution means the URL is not replaced, and [L] tells Apache to stop processing the current set of rewrite rules after this match.
7. Check Whether the Requested File Exists
RewriteCond %{REQUEST_FILENAME} !-fThis condition checks whether the requested filesystem path is not an existing regular file.
For example, if a visitor requests an existing image such as /wp-content/uploads/example.jpg, the file should be served directly rather than sent through WordPress’s front controller.
8. Check Whether the Requested Directory Exists
RewriteCond %{REQUEST_FILENAME} !-dThis condition checks whether the requested filesystem path is not an existing directory.
Together, the !-f and !-d conditions ensure that requests for existing files and directories are handled differently from requests that need WordPress to resolve their content.
9. Send Other Requests to index.php
RewriteRule . /index.php [L]If the preceding conditions are satisfied, this rule rewrites the request to WordPress’s index.php.
WordPress then interprets the requested URL and retrieves the appropriate content.
This is the key mechanism that makes clean permalinks work on a typical Apache installation.
How to Restore the Default WordPress .htaccess File
If your WordPress website has permalink problems, restoring the rewrite rules may help. However, make sure the issue is actually related to .htaccess before changing the file.
Step 1: Back Up Your Existing File
Before making any changes, create a copy of your current .htaccess file.
You can do this through cPanel File Manager, an FTP client, or your hosting provider’s file management interface.
Save a copy locally so that you can restore the previous configuration if the new rules cause problems.
Step 2: Locate the .htaccess File
Open the directory containing your WordPress installation.
On many shared hosting accounts, the website root directory is named public_html. However, your installation may use a different directory.
Remember that filenames beginning with a dot are often hidden. Enable the option to show hidden files in your file manager or FTP client if .htaccess is not visible.
Step 3: Edit the File
Open .htaccess in a text editor.
If you are restoring a standard WordPress root installation, replace the relevant WordPress-managed rewrite section with the default rules shown earlier in this article.
Do not remove unrelated custom directives without understanding what they do. Other applications, plugins, security rules, redirects, and hosting configurations may depend on them.
Step 4: Save and Test Your Website
Save the file and visit your homepage.
Next, test several pages and posts, including at least one URL that uses a custom permalink. Check your WordPress dashboard and any important API endpoints or redirects that your site relies on.
If you encounter a server error, restore the backup and review the configuration before trying again.
Step 5: Refresh Your Permalink Settings
You can also regenerate WordPress’s rewrite rules through the dashboard:
- Log in to your WordPress administration area.
- Navigate to Settings → Permalinks.
- Review your current permalink structure.
- Click Save Changes.
WordPress may update its rewrite rules automatically if it has the required permissions. If it cannot write to .htaccess, the dashboard may display the rules that need to be copied into the file manually.
You do not need to change your permalink structure just to refresh the rules.
Common WordPress .htaccess Problems and Solutions
1. WordPress Pages Return a 404 Error
If your homepage works but individual posts or pages return 404 errors, your permalink rewrite configuration may be missing or incorrect.
Try these steps:
- Open Settings → Permalinks and save the current settings.
- Confirm that Apache’s
mod_rewritemodule is enabled. - Check that
.htaccessis located in the correct directory. - Verify that your hosting configuration permits the required rewrite directives.
If the issue continues, contact your hosting provider to check the Apache configuration.
2. You Get an Internal Server Error (500)
A malformed .htaccess directive or a directive that is not permitted by the server can trigger an HTTP 500 error.
To troubleshoot:
- Restore the last known working version of
.htaccess. - Review any recently added rewrite rules or security directives.
- Check your hosting error logs for the exact Apache error.
- Ask your hosting provider whether the directive is supported in your environment.
Avoid adding multiple unverified rules at once. Make one change at a time so you can identify the cause.
3. WordPress Cannot Update .htaccess
If WordPress displays a message indicating that it cannot write to .htaccess, you may need to update the file manually.
First, confirm that the file is owned by the correct account and has appropriate permissions for your hosting environment.
Do not solve this by granting everyone write access. File permissions should be as restrictive as practical while still allowing the required operation.
If you are unsure about ownership or permissions, ask your hosting provider for assistance.
4. Your Site Uses Nginx Instead of Apache
The .htaccess rules shown in this article will not work on a server that uses Nginx alone.
For a typical WordPress installation, the Nginx configuration commonly includes a rule similar to:
location / {
try_files $uri $uri/ /index.php?$args;
}This is an illustrative snippet, not a complete Nginx virtual-host configuration. It must be integrated into the appropriate server block and used with a correctly configured PHP handler.
If your hosting uses Nginx, a reverse proxy, or a combination of Nginx and Apache, ask your hosting provider which server handles the site’s URL rewriting.
5. A Plugin Changes Your .htaccess File
Caching, security, redirect, and optimization plugins may add or modify directives in .htaccess.
If the problem started immediately after installing or updating a plugin, review the plugin’s documentation and compare the current file with your backup.
Do not delete every custom rule automatically. Some rules may be necessary for redirects, access restrictions, caching, or other website features.
Best Practices for WordPress .htaccess
To keep your WordPress site stable and easier to maintain, follow these recommendations:
- Keep a backup: Save the current file before changing rewrite rules.
- Avoid unnecessary directives: Every additional rule can introduce conflicts or unexpected behavior.
- Use HTTPS: Configure HTTPS correctly through your hosting environment and WordPress settings.
- Check before adding security rules: An incorrect restriction can block legitimate requests or interfere with plugins.
- Use the correct server configuration: Apache and Nginx require different approaches to URL rewriting.
- Test after changes: Check your homepage, posts, pages, login area, and other important features.
- Protect sensitive files: Do not rely on the default WordPress rewrite rules as a complete security solution. Ensure your server is configured so sensitive files, backups, and configuration files cannot be downloaded publicly.
Frequently Asked Questions
Does Every WordPress Website Need an .htaccess File?
No. WordPress commonly uses .htaccess for pretty permalinks on Apache, but other server environments handle URL rewriting differently. Nginx, for example, uses its server configuration rather than .htaccess.
Can I Delete the WordPress .htaccess File?
Deleting it may cause pretty permalinks or other configured rules to stop working. Before removing it, back it up and understand what it contains. If you need to restore the standard WordPress rules, use the appropriate configuration for your installation.
Where Is the WordPress .htaccess File Located?
It is commonly found in the root directory of the WordPress installation, often public_html on shared hosting. It may be hidden by default in file managers and FTP clients.
Does .htaccess Improve WordPress Security?
It can be used to implement certain access restrictions and server behaviors, but the default WordPress rewrite rules are primarily intended to support URL routing. They do not replace secure file permissions, updates, HTTPS, appropriate server configuration, and other security practices.
What Should I Do If Pretty Permalinks Still Do Not Work?
Start by saving the permalink settings, checking the rewrite configuration, and reviewing the server’s error logs. If the problem persists, verify the web server type and ask your hosting provider to confirm that the necessary rewrite functionality is enabled.
Conclusion
The default WordPress .htaccess configuration plays an important role in handling clean URLs on Apache-based websites. Its rewrite rules allow WordPress to process requests for posts, pages, and other content while leaving existing files and directories to be served normally.
If you need to troubleshoot permalink errors, start with a backup, restore the appropriate rewrite rules, and test the website carefully. Remember that the configuration depends on your installation and web server, so the standard rules should not be applied blindly to every environment.
For more details, consult the official documentation:
