WordPress .htaccess Generator
The rules WordPress needs, plus the hardening rules it does not ship with
Runs in your browser. Nothing is uploaded.
About the WordPress .htaccess Generator
Generate a WordPress .htaccess file: the default rewrite rules, forced HTTPS, www-to-apex redirects, wp-login brute-force blocking, XML-RPC blocking, and wp-config protection. Copy it out and paste it in.
FAQ
Questions
Why did my custom .htaccess rules disappear?
Because they were inside the '# BEGIN WordPress' block. WordPress rewrites everything between its BEGIN and END markers whenever you save your permalink settings, silently deleting anything you added there. Custom rules must go ABOVE that block.
Does blocking xmlrpc.php stop brute-force attacks?
It closes one door, not all of them. Attackers can still hit wp-login.php directly. It is worth blocking if nothing you use needs it — but be aware that the WordPress mobile app and Jetpack both do.
My host runs nginx. Does .htaccess work?
No. nginx ignores .htaccess entirely — the file will sit there doing nothing. Many managed WordPress hosts run nginx, so if your rules seem to have no effect at all, check which server you are actually on before debugging the rules themselves.