.htaccess and Nginx Rules Cheat Sheet for WordPress

This sheet pairs each Apache (and LiteSpeed) .htaccess rule with its Nginx equivalent. Apache reads .htaccess files on every request, in every directory from the document root down, if the server config allows it with AllowOverride. Nginx has no per-directory files: rules go in the server config (usually a file under /etc/nginx/sites-available/ or /etc/nginx/conf.d/) and only take effect after a reload. On shared hosting you can usually edit .htaccess but not the Nginx config, so ask your host for Nginx changes.

Placeholders: EXAMPLE.COM is your bare domain, WWW.EXAMPLE.COM your preferred host, /PATH/TO/ an absolute filesystem path, 203.0.113.10 an example IP address (from the documentation range, replace it with yours), and PHP-VERSION the PHP-FPM socket name your server uses. Before you edit: download a copy of the working .htaccess. One typo produces a site-wide 500 error, and restoring the copy is the fix.

Default WordPress rewrite blocks

WordPress writes the single-site block itself when you save Settings, Permalinks (if the file is writable). Keep your own rules outside the # BEGIN WordPress and # END WordPress markers, because WordPress may rewrite everything between them. Put redirects above the WordPress block so they run before the catch-all.

Single site

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

Multisite, subdirectory network

RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]

# add a trailing slash to /wp-admin
RewriteRule ^([_0-9a-zA-Z-]+/)?wp-admin$ $1wp-admin/ [R=301,L]

RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
RewriteRule ^([_0-9a-zA-Z-]+/)?(wp-(content|admin|includes).*) $2 [L]
RewriteRule ^([_0-9a-zA-Z-]+/)?(.*\.php)$ $2 [L]
RewriteRule . index.php [L]

Multisite, subdomain network

RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]

# add a trailing slash to /wp-admin
RewriteRule ^wp-admin$ wp-admin/ [R=301,L]

RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
RewriteRule ^(wp-(content|admin|includes).*) $1 [L]
RewriteRule ^(.*\.php)$ $1 [L]
RewriteRule . index.php [L]

The Network Setup screen (Tools, Network Setup) prints the exact rules for your install, including a different RewriteBase if WordPress lives in a subfolder. Copy from there when in doubt.

Nginx equivalent

location / {
    try_files $uri $uri/ /index.php?$args;
}

location ~ \.php$ {
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_pass unix:/run/php/PHP-VERSION-fpm.sock;
}

Force HTTPS and the canonical host in one hop

A chain such as http://EXAMPLE.COM to https://EXAMPLE.COM to https://WWW.EXAMPLE.COM costs an extra round trip and dilutes redirect signals. One rule can fix both scheme and host at once.

Apache

RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} !^www\.example\.com$ [NC]
RewriteRule ^ https://www.example.com%{REQUEST_URI} [R=301,L,NE]

To prefer the bare domain, swap the host in both lines (!^example\.com$ and https://example.com).

Apache behind a CDN, proxy or load balancer

When TLS ends at the proxy, the origin sees plain HTTP and %{HTTPS} is always off, which causes a redirect loop. Test the forwarded header instead (confirm which header your proxy sends):

RewriteCond %{HTTP:X-Forwarded-Proto} !https [OR]
RewriteCond %{HTTP_HOST} !^www\.example\.com$ [NC]
RewriteRule ^ https://www.example.com%{REQUEST_URI} [R=301,L,NE]

Nginx

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://www.example.com$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name example.com;
    ssl_certificate     /PATH/TO/fullchain.pem;
    ssl_certificate_key /PATH/TO/privkey.pem;
    return 301 https://www.example.com$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name www.example.com;
    # certificate lines and the real site config go here
}

The certificate must cover both names, or browsers show a certificate error on the bare domain before the redirect can happen. Also set the WordPress Address and Site Address (Settings, General) to the same canonical URL, or WordPress will redirect back.

301 redirects on Apache

RewriteCond %{HTTP_HOST} ^(www\.)?old-example\.com$ [NC]
RewriteRule ^ https://www.example.com%{REQUEST_URI} [R=301,L,NE]

RewriteRule flags

Variables for RewriteCond

Redirecting a URL with a query string

The RewriteRule pattern never sees the query string. Match it with a condition and drop it with QSD:

RewriteCond %{QUERY_STRING} (^|&)page_id=42(&|$)
RewriteRule ^$ /about/ [R=301,L,QSD]

Redirects on Nginx: return vs rewrite

Location matching order: exact = first, then the longest prefix (a ^~ prefix stops the search), then regex locations (~ and ~*) in the order they appear in the file, and finally the longest plain prefix if no regex matched.

Block xmlrpc.php

XML-RPC is used for brute-force and pingback abuse. It is also used by the Jetpack plugin and some older mobile and publishing apps, so check before blocking.

<Files xmlrpc.php>
Require all denied
</Files>

<Files xmlrpc.php>
Require ip 203.0.113.10
</Files>

Protect sensitive files and stop PHP in uploads

<Files wp-config.php>
Require all denied
</Files>

<FilesMatch "^\.ht">
Require all denied
</FilesMatch>

<FilesMatch "\.(bak|sql|log|old|orig|swp)$">
Require all denied
</FilesMatch>

<Files debug.log>
Require all denied
</Files>

<FilesMatch "\.(?i:php[0-9]?|phtml|phar)$">
Require all denied
</FilesMatch>

Old vs new Apache access syntax

Do not mix the two styles in one context. Apache 2.4 only understands the old lines when mod_access_compat is loaded, and mixing them gives confusing results.

Security headers

Values below are a starting baseline. CS-12 explains each header and its WordPress caveats. Test Content-Security-Policy in Report-Only mode first.

Apache (needs mod_headers)

<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>

Nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

Browser caching

Apache: mod_expires plus Cache-Control

<IfModule mod_expires.c>
ExpiresActive On
ExpiresDefault "access plus 1 hour"
ExpiresByType text/html "access plus 0 seconds"
ExpiresByType text/css "access plus 1 year"
ExpiresByType application/javascript "access plus 1 year"
ExpiresByType text/javascript "access plus 1 year"
ExpiresByType image/webp "access plus 1 year"
ExpiresByType image/avif "access plus 1 year"
ExpiresByType image/jpeg "access plus 1 year"
ExpiresByType image/png "access plus 1 year"
ExpiresByType image/svg+xml "access plus 1 year"
ExpiresByType font/woff2 "access plus 1 year"
</IfModule>

mod_expires sets both the Expires header and Cache-Control: max-age. A one-year lifetime is only safe for files whose URL changes when the content changes (WordPress adds ?ver= to enqueued CSS and JS). To add directives such as immutable, use mod_headers:

<FilesMatch "\.(css|js|woff2|webp|avif|jpe?g|png|svg)$">
Header set Cache-Control "public, max-age=31536000, immutable"
</FilesMatch>

Nginx

location ~* \.(css|js|woff2|webp|avif|jpe?g|png|gif|svg|ico)$ {
    expires 1y;
    add_header Cache-Control "public, immutable";
    # repeat security headers here (inheritance gotcha)
    try_files $uri =404;
}

expires 1y; sets Expires and Cache-Control: max-age=31536000. expires off; leaves the headers alone, and expires epoch; marks the response as already expired.

Compression

<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/html text/css text/plain text/xml application/javascript text/javascript application/json application/xml image/svg+xml
</IfModule>

<IfModule mod_brotli.c>
AddOutputFilterByType BROTLI_COMPRESS text/html text/css application/javascript application/json image/svg+xml
</IfModule>

gzip on;
gzip_types text/css application/javascript application/json image/svg+xml text/plain text/xml application/xml;
gzip_vary on;
gzip_min_length 1024;

CORS for web fonts

Browsers block cross-origin font loads (for example from a CDN hostname or a second domain) unless the font response carries Access-Control-Allow-Origin.

<FilesMatch "\.(woff2?|ttf|otf|eot)$">
Header set Access-Control-Allow-Origin "https://www.example.com"
</FilesMatch>

The header takes one origin or *, never a list. For several origins, echo back the matched Origin and add Vary: Origin so caches keep the variants apart.

IP allow and deny

<RequireAll>
Require all granted
Require not ip 203.0.113.10
</RequireAll>

<Files wp-login.php>
Require ip 203.0.113.10
</Files>

Nginx checks allow and deny in order and stops at the first match. Behind a CDN or proxy, the server sees the proxy IP: configure mod_remoteip (Apache) or the realip module (Nginx, set_real_ip_from and real_ip_header) with the proxy’s published ranges first, or you may block the whole CDN.

Basic auth for a staging site

AuthType Basic
AuthName "Staging"
AuthUserFile /PATH/TO/.htpasswd
Require valid-user

auth_basic "Staging";
auth_basic_user_file /PATH/TO/.htpasswd;

-c creates the file and overwrites an existing one. Leave it off when adding a second user. Basic auth sends the password with every request, so only use it over HTTPS. It also blocks WordPress loopback requests and WP-Cron on that site, which Site Health will report.

Upload and PHP limits

Where you set PHP values depends on how PHP runs. Check the Server API line in Tools, Site Health, Info, Server, or in a phpinfo() page (delete it afterward).

php_value upload_max_filesize 64M
php_value post_max_size 64M
php_value memory_limit 256M
php_value max_execution_time 120

upload_max_filesize = 64M
post_max_size = 64M

LiteSpeed notes

Testing

Common recipes

RewriteCond %{REMOTE_ADDR} !^203\.0\.113\.10$
RewriteCond %{REQUEST_URI} !^/maintenance\.html$
RewriteRule ^ /maintenance.html [R=302,L]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^wp-content/uploads/(.*)$ https://www.example.com/wp-content/uploads/$1 [R=302,L]

location /wp-content/uploads/ { try_files $uri @prod; }
location @prod { return 302 https://www.example.com$request_uri; }

RewriteCond %{HTTP_USER_AGENT} BADBOTNAME [NC]
RewriteRule ^ - [F]

Gotchas