Knowledgebase

 

2. Protect the wp-config.php File

The wp-config.php file stores critical database credentials and configuration settings. Shield it from unauthorized access:

<Files wp-config.php>
Order Allow,Deny
Deny from all
</Files>

3. Block Malicious IP Addresses

If certain IPs are attempting suspicious activity, block them outright:

Order allow,deny
Deny from 123.45.67.89
Allow from all

You can add multiple Deny from lines to block multiple IPs or ranges.

4. Prevent Image Hotlinking

Hotlinking allows other websites to use your images and drain your server’s bandwidth. Use this rule to block it:

# Prevent hotlinking of images
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?yourdomain.com [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ - [NC,F,L]

 Customize file types based on your needs.

6. Force HTTPS for Secure Connections

Ensure all visitors access your site via a secure (HTTPS) connection:

# Force HTTPS
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Make sure your SSL certificate is installed before enabling this rule.

7. Secure File & Folder Permissions (via SSH)

Although not part of .htaccess, file permissions play a critical role. You can set secure permissions using SSH or Terminal:

 chmod 644 filename.ext # Recommended for files
chmod 755 directory_name # Recommended for folders

Important Note

Always back up your current .htaccess file before making changes. A small error can cause your website to malfunction. If you're unsure, contact our support team — we’re here to assist you every step of the way.

Need Help?

At Prabhu Host, we are committed to helping you maintain a secure and high-performing WordPress website. For questions or support with .htaccess configurations, feel free to reach out to our expert support team.