Hardened .htaccess Generator

Redirects all HTTP traffic to HTTPS (301 permanent)

Canonicalizes the domain with www (avoids duplicate content)

Canonicalizes the domain without www

⚠ Don't enable together with 'Force www'

Tells the browser to use HTTPS for 1 year. Prevents man-in-the-middle attacks

Prevents your site from being embedded in iframes on other domains (clickjacking). OWASP A05

Prevents the browser from guessing MIME types, preventing MIME sniffing attacks

Controls what referrer information is sent when navigating to other sites

Disables access to camera, microphone, geolocation and other sensitive APIs

Enables the XSS filter on legacy browsers (old IE/Edge)

⚠ Restrictive CSP policy. May break external scripts. Adjust to your stack

⚠ Adjust if you use Google Fonts, Analytics or external CDNs

Neutralizes one of the most common brute-force attack vectors on WordPress

Filters typical SQL injection patterns in the query string. OWASP A03

Blocks script injection attempts in URL parameters. OWASP A03

Prevents access to server files via relative paths. OWASP A01

Rejects user-agents from known hacking tools and scrapers

Prevents PHP/executable files in the uploads folder from running (WebShells)

Restricts admin panel access to only your IP

⚠ Replace TU_IP_AQUI with your real IP. Careful with dynamic IPs

Denies direct access to sensitive configuration files

Prevents Apache from listing folder contents without index.html. OWASP A05

Removes headers revealing the Apache version and OS. OWASP A05

Prevents other sites from using your bandwidth by loading your images directly

✏ Replace tudominio.com with your real domain

Prevents access to backups (.bak, .old, .zip, .sql) commonly left accidentally public

Compresses HTML, CSS, JS before sending to the browser. Reduces size by 60-80%

Sets cache times for different file types. Improves speed on repeat visits

Removes ETags to reduce HTTP overhead and avoid leaking the server inode

Limits request body to 10MB to prevent massive payload attacks

Only allows GET, POST and HEAD. Blocks TRACE, TRACK, DELETE, PUT (prevents CSRF/XST)

⚠ Don't enable if you run a REST API on this server

Blocks the original /wp-admin and /wp-login.php and creates a custom secret URL

⚠ Replace 'mi-acceso-secreto' with the URL you want. Keep it safe.

Prevents attackers from discovering usernames via ?author=1 (brute force vector)

Blocks feeds if you don't need them (reduces attack surface and scraping)

⚠ Don't enable if you use RSS for newsletters or syndication

Limits the REST API to authenticated users only (prevents data exposure)

⚠ May break plugins that use the REST API publicly