How to Edit the .htaccess File

.htaccess is a plain-text file of Apache (or LiteSpeed) directives that applies to the folder it sits in and every folder below it; for a website it usually lives in the document root, such as public_html. Its name starts with a dot, so file managers hide it until hidden files are shown.

• Location: /home/username/public_html/.htaccess for the main domain; each addon domain has its own folder and file.
• Permissions: 644. Over-permissive settings such as 777 cause 500 errors on many shared servers.
• Scope: the folder and its subfolders, unless a subfolder has its own file.
• Servers: Apache and LiteSpeed read it; Nginx ignores it completely.

WordPress writes a block between # BEGIN WordPress and # END WordPress and rewrites it when permalinks are saved, so put your own rules above or below those markers, never inside.

The most useful .htaccess rules force HTTPS, choose www or non-www, set browser caching, add security headers and block sensitive files. Wrap module-dependent rules in <IfModule> so a missing module does not cause a 500.

# 1. Force HTTPS (single server, no proxy in front)
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# 2. Redirect www to the bare domain
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]

# 3. Browser caching for static files
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType image/webp "access plus 1 year"
  ExpiresByType text/css "access plus 1 month"
  ExpiresByType application/javascript "access plus 1 month"
</IfModule>

# 4. A security header
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
</IfModule>

# 5. Block a file (Apache 2.4 syntax)
<Files "xmlrpc.php">
  Require all denied
</Files>

Behind Cloudflare or another proxy, %{HTTPS} can read "off" even for secure visits and cause a redirect loop; test with %{HTTP:X-Forwarded-Proto} instead, or set the redirect at the proxy. Apache 2.4 uses Require; the old Order/Allow/Deny lines work only through a compatibility module.

Redirect patterns are covered in depth in the .htaccess 301 redirect guide, and the .htaccess generator builds a starter file.

Load the home page and one inner page in a private window, then check the response code of the URL the rule targets; if every page returns 500, rename .htaccess and restore the backup. Deleting or renaming the file brings the site back immediately with server defaults.

curl -I https://example.in/old-page/      # expect 301 and a Location header
curl -I http://example.in/                # expect 301 to https://