Forked from JayHoltslander/jays-wp-htaccess / Original work by Jay Holtslander.
An improved and modernized .htaccess file for WordPress websites, updated in 2026 with enhanced security, modern file type support, and detailed beginner-friendly comments.
| Feature | Original (2021) | This fork (2026) |
|---|---|---|
| Security headers | Basic | Permissions-Policy, Referrer-Policy, improved CSP |
| Image formats | WebP | + AVIF, HEIC, HEIF |
| WebAssembly | No | Yes |
| Comment quality | Short | Detailed - explains why, not just what |
| Duplicate declarations | Present | Fixed |
| HSTS preload guidance | Partial | Complete with registration link |
| Beginner-friendly | Partial | Every rule explained in plain English |
- Beginners and juniors - every single rule has a comment explaining what it does and why it exists
- WordPress developers - covers all common WP security and performance needs
- Anyone using Apache - works on any Apache-based hosting (shared, VPS, dedicated)
- Download the
.htaccessfile - Make a backup of your current
.htaccessfirst! - Replace your existing
.htaccessat the root of your WordPress installation - Read the comments - most sections are commented out by default. Activate only what you need by removing the
#characters. - Test your site after each change
- Section 1 - WordPress core rewrite rules
- Section 2 - HTTPS / SSL forcing + HSTS
- Section 3 - URL canonicalization (www vs no-www)
- Section 4 - Security headers (X-Frame-Options, CSP, Referrer-Policy, Permissions-Policy...)
- Section 5 - WordPress-specific security (wp-config, xmlrpc, username enumeration...)
- Section 6 - Compression (mod_deflate / gzip)
- Section 7 - Browser caching (Expires headers)
- Section 8 - MIME types (including AVIF, HEIC, WebAssembly, modern fonts)
- Section 9 - Character encoding (UTF-8)
- Section 10 - CORS headers
- Section 11 - Force file downloads
- Section 12 - Custom error pages
- Section 13 - PHP settings
- Section 14 - Legacy browser compatibility
- Section 15 - 301 redirects
| Tool | What it does |
|---|---|
| securityheaders.com | Test your security headers |
| ssllabs.com | Test your SSL certificate |
| hstspreload.org | Register for HSTS preload list |
| htaccess.madewithlove.com | Debug your .htaccess rules |
| webpagetest.org | Test your site speed |
MIT same as the original project. See LICENSE.
Improved by madjeek-web / February 2026