Pick the hardening and speed rules you want, and copy a production-safe .htaccess block for your Apache or LiteSpeed server. Back up your current .htaccess before pasting — and test your site after saving. Nginx users: these directives do not apply to you.
| Rule | What it does |
|---|---|
| 301 all HTTP traffic to HTTPS | |
| Compress HTML, CSS, JS, SVG and XML responses | |
| Long-lived cache headers for static assets | |
| Blocks brute-force amplification (skip if you publish via Jetpack/mobile app) | |
| Stops index browsing of folders without index files | |
| X-Content-Type-Options, X-Frame-Options, Referrer-Policy |
Tested patterns we use on client Nginx/Apache stacks — but every host differs. If your site 500s after saving, restore your backup immediately. Managed hosts often manage caching at the server level already; ask before duplicating it.