.htaccess
Quick Definition
.htaccess is a configuration file for Apache web servers that WordPress uses to handle pretty permalinks, redirects, and security rules. It sits in your WordPress root directory.
What Is .htaccess?
.htaccess (short for "hypertext access") is a distributed configuration file for the Apache web server. WordPress uses it to enable pretty permalinks via mod_rewrite.
Default WordPress .htaccess:
# BEGIN WordPress
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
# END WordPress.htaccess in Practice
Hidden file in WordPress root. Auto-generated when you set permalinks. Custom uses: redirects, security rules, GZIP compression, browser caching.
Apache-only — Nginx doesn't use .htaccess. A typo causes 500 errors. Always backup before editing.
Why It Matters
Controls your URLs, security, and server behavior. See our speed guide and security guide.
Related Terms
CachingCaching stores copies of your website data in a faster location so pages load quicker. WordPress uses three types: page cache (full HTML pages), object cache (database queries), and browser cache (static files on visitors' devices).PermalinkA permalink is the permanent URL of a WordPress post, page, or archive. The recommended structure is Post Name (/%postname%/) which creates clean, readable URLs like yoursite.com/my-great-article/.wp-config.phpwp-config.php is the most important configuration file in WordPress. It contains your database credentials, security keys, and core settings that WordPress needs to connect to your database and run.
Related Articles
WordPress File Permissions — Security Best Practices ExplainedWrong file permissions are one of the most overlooked WordPress security holes. I've seen sites hacked because wp-config.php was world-readable. Here's exactly what every file and folder should be set to, and how to fix it.WordPress Security Guide: 12 Steps to Protect Your SiteWordPress doesn't get hacked because it's insecure — it gets hacked because people skip basic precautions. Here are the 12 security steps I follow on every site I build, ranked by importance.How to Speed Up WordPress: 10 Proven Optimizations (2026 Guide)A slow WordPress site is bleeding visitors, rankings, and revenue. I've spent 20 years optimizing websites, and these are the 10 changes that actually move the needle — ranked by impact, with exact steps you can follow right now.