6 .htaccess Hacks To Improve WordPress Security & SEO

Getting attention with your WordPress website is something that you want; however, when the view-counts start getting serious, it’s not only people interested in what you have to offer that will come your way. It’s also those that want to spam, hack and leech and keeping your site clean and safe can quickly become overwhelming

If you’re just starting your blog or website, you might not want to jump on the very expensive security bandwagon, not until the revenue from the site justifies it. But you’ll still want to curb the efforts of some of the people who want to do your site harm. One easy and free way to do it, that actually works great, is via the .htaccess file.

.htaccess is a config file that is read and executed inside Apache Web Server software and it can specify security measures that are to be used in the directory it is placed in. These are security restrictions and configuration optimizations, so that the server side will work faster and leaner.

Here are 6 easy tweaks you can make to the the .htaccess file to protect your site.

After applying the hacks in this article you’ll probably also want to know how to protect WordPress folders on your server, so check it out when you’re done.

Note: Before you start messing around in your .htaccess please make a backup copy and load your site in the browser regularly. One wrong move in that file and your site will go down. You’ve been warned. Now let’s rock and roll!

1. Restricting access to your WP Admin to a single IP address

One way that hackers will try to get inside your platform is via attacks on the WP admin area. To stop them in their tracks you can prevent access from all IPs aside from your own. Add the following code to your .htaccess. Make sure to replace a.b.c.d with your IP. You can find your IP by going here.

order deny,allow

allow from a.b.c.d # This is your static IP

deny from all

This method won’t work for everyone. For example, if you are using a Wifi connection there’s a good chance that IP will change from each time you connect to your router. You’ll also have a different IP if you have a laptop and connect to the internet in different locations.

2. Restricting Hotlinking Images

Some of your content may be used by other parties without even duplicating your content. They link directly to the images on your site and show them on their site. This direct linking is called “Hotlinking”. Essentially, you’re paying for the bandwidth and they get the benefit of your content.

To prevent hotlinking, add the following code to your .htaccess file:

#disable hotlinking of images with forbidden or custom image option

RewriteEngine on

RewriteCond %{HTTP_REFERER} !^$

RewriteCond %{HTTP_REFERER} !^http://(www\.)?yourdomain.com/.*$ [NC]

#RewriteRule \.(gif|jpg|png)$ – [F]

RewriteRule \.(gif|jpg|png)$ http://www.yourdomain.com/stealingisbadkarma.jpg [R,L]

Replace yourdomain.com with your actual domain name.

What this code will do is whenever someone links to an image on your site, instead of showing the image they linked to it will show the image stealingisbadkarma.jpg So make sure you have that image created and uploaded to your website root. We use this one:

Serving this image to other sites still uses your bandwidth, but it won’t be long before the culprit stops hotlinking.

3. Detecting and stopping spammers

While spam messages can be sent to you by referrer enabled sources, this is more time consuming to set-up by spammers, so they usually don’t do it. Instead, you can deny them from commenting on your platform by identifying and denying no-referrer spam bots. The code to use is the following:

RewriteEngine On

RewriteCond %{REQUEST_METHOD} POST

RewriteCond %{REQUEST_URI} .wp-comments-post\.php*

RewriteCond %{HTTP_REFERER} !.*yourdomain.com.* [OR]

RewriteCond %{HTTP_USER_AGENT} ^$

RewriteRule (.*) ^http://%{REMOTE_ADDR}/$ [R=301,L]

Again, make sure you replace yourdomain.com with your actual domain name.

4. Keep .htaccess Secure!

What good are all these tweaks, if you’re failing to keep the file itself secure?! No good, no good at all!

Luckily, you can secure this file form attack, by adding the following code to it. This will prevent external access to it, by denying all access to files that have the “hta” sequence at the beginning:

<Files ~ “^.*\.([Hh][Tt][Aa])”>

order allow,deny

deny from all

satisfy all

</Files>

5. Uber-Security Tip: Change The Name Of The .htaccess File!

Change the name of the file to something only you’d know, so that hackers won’t have a clue what to target. Here’s an example you can copy and paste into your .htaccess file:

# rename htaccess files

AccessFileName ht.access

The code above will rename .htaccess to ht.access.

6. Remove The www In Your URL

Add the following code to your .htaccess:

RewriteEngine On

RewriteCond %{HTTP_HOST} !^yourdomain.com$ [NC]

RewriteRule ^(.*)$ http://yourdomain.com/$1 [L,R=301]

As always, replace yourdomain.com with your actual domain name.

Most website you visit will be accessible via http://www.domainname.com and http://domainname.com. To the average user, there’s nothing wrong with that, but according to Google, that’s duplicate content. Doesn’t make much sense, but that’s how it is. Since Google says it’s not a fan of duplicate content it’s a good idea to redirect traffic to either the “www” version or the “non-www” version.

Whether or not Google actually penalized duplicate content is debatable, but that’s a different topic.

If you have any trouble implementing any of these, let us know and we’ll help!

Code Sources: https://www.tipsandtricks-hq.com, http://css-tricks.com