.htaccess is a configuration file read by the Apache web server (and LiteSpeed, which is compatible). Placed in your site’s root folder, it controls redirects, security headers, caching, compression and access rules without editing the main server configuration. It does not work on Nginx servers; those use a different config format.
Before you edit it
Download a backup of your current .htaccess through your host’s file manager or FTP.
Add new rules outside the # BEGIN WordPress … # END WordPress block. WordPress rewrites everything between those lines.
Add one group of rules at a time and reload your site. A typo can cause a “500 Internal Server Error”; if that happens, restore the backup.
Common rules and what they do
Force HTTPS: redirects every http:// request to https:// with a 301, so visitors and search engines use one secure version.
www or non-www: picks one hostname and redirects the other, avoiding duplicate versions of every page.
Security headers:X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN and Referrer-Policy reduce some browser-based attacks. These need Apache’s mod_headers.
Block directory listing:Options -Indexes stops visitors from browsing folders that have no index file.
Protect sensitive files: deny web access to files like wp-config.php and .htaccess itself.
Browser caching and compression:mod_expires and mod_deflate rules tell browsers to keep images, CSS and JS longer and compress text files, which speeds up repeat visits.
Good to know
Caching plugins (such as WP Rocket) and security plugins also write to .htaccess. Don’t duplicate the same rules by hand.
Some managed hosts ignore certain directives. If a rule seems to have no effect, check with your host.
For single-page redirects, the bulk 301 redirect generator or your SEO plugin’s redirection manager is often simpler.
