Security and .htaccess

UPDATE: When I first posted my answer I missed the crux of the question; my answer was about .htaccess security in general and is now listed below the double line (look down if it interests you.) Unfortunately I don’t have specific experience with securing /wp-admin/ using .htaccess so I’ll simply list the two resources I … Read more

Improve wordpress security by hiding non public resources

Using remove_action() can be remove unnecessary links for example: remove_action(‘wp_head’, ‘rsd_link’); //removes EditURI/RSD (Really Simple Discovery) link. remove_action(‘wp_head’, ‘wlwmanifest_link’); //removes wlwmanifest (Windows Live Writer) link. remove_action(‘wp_head’, ‘wp_generator’); //removes meta name generator. remove_action(‘wp_head’, ‘wp_shortlink_wp_head’); //removes shortlink. remove_action( ‘wp_head’, ‘feed_links’, 2 ); //removes feed links. remove_action(‘wp_head’, ‘feed_links_extra’, 3 ); //removes comments feed.

Masking wp-content/themes/name/images to just images directory using htaccess

Check out the Roots WordPress Theme. They seem to do exactly what you want with the URLs. Here’s a snippet from their roots-htaccess.php file: add_action( ‘generate_rewrite_rules’, ‘roots_add_rewrites’ ); function roots_add_rewrites($content) { $theme_name = next( explode( ‘/themes/’, get_stylesheet_directory() ) ); global $wp_rewrite; $roots_new_non_wp_rules = array( ‘css/(.*)’ => ‘wp-content/themes/’ . $theme_name . ‘/css/$1’, ‘js/(.*)’ => ‘wp-content/themes/’ . … Read more

Redirect entire website to a single page

You can actually do this from inside WordPress itself, instead of needing to come up with a confusing and overengineered .htaccess fix. We can hook into the template_redirect filter, which only fires on the front-end (not in wp-admin). We then use the is_page() function to check if we’re viewing a page with the ID of … Read more

WordPress Redirect All HTTP requests to HTTPS via .htaccess

I see, when you enter a link to your page other than your home, example: http://www.michaelcropper.co.uk/contact-me www.michaelcropper.co.uk/contact-me michaelcropper.co.uk/contact-me If https:// is not in the prefix, the HTTP link loads instead. Add the following into your .htaccess in between the <IfModule mod_rewrite.c> tag: RewriteCond %{HTTPS} !=on RewriteRule ^(.*) https://%{SERVER_NAME}/$1 [R,L] If there were no additional modifications … Read more

How do I skip wordpress’s 404 handling and redirect all 404 errors for static files to 404.html?

.htaccess skip WordPress 404 error handling for static files. <IfModule mod_rewrite.c> RewriteEngine On RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_URI} !(robots\.txt|sitemap\.xml(\.gz)?) RewriteCond %{REQUEST_FILENAME} \.(css|js|html|htm|rtf|rtx|svg|svgz|txt|xsd|xsl|xml|asf|asx|wax|wmv|wmx|avi|bmp|class|divx|doc|docx|exe|gif|gz|gzip|ico|jpg|jpeg|jpe|mdb|mid|midi|mov|qt|mp3|m4a|mp4|m4v|mpeg|mpg|mpe|mpp|odb|odc|odf|odg|odp|ods|odt|ogg|pdf|png|pot|pps|ppt|pptx|ra|ram|swf|tar|tif|tiff|wav|wma|wri|xla|xls|xlsx|xlt|xlw|zip)$ [NC] RewriteRule .* – [L] </IfModule> Note: These rules were generated by the W3 Total Cache plugin* Nginx skip WordPress 404 handling for static files. if (-f $request_filename) { break; … Read more

Default .htaccess file for WordPress?

Here is the default code for that file. # BEGIN WordPress <IfModule mod_rewrite.c> RewriteEngine On RewriteBase / RewriteRule ^index\.php$ – [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L] </IfModule> # END WordPress you can check it here for default htaccess file. http://codex.wordpress.org/Using_Permalinks. Thanks. I hope it helps little.

“Too many redirects” ONLY when trying to access wp-admin page

I found a solution that fixed my issue. Sources: A.) https://sharpten.com/blog/2018/01/17/wordpress-stuck-many-redirects-error-loop-using-ssl.html B.) (Sublink within A) https://wordpress.org/support/article/administration-over-ssl/ Excerpt: Adding the following lines of code at the end of my wp-config.php file resolved the redirect conflict. if (strpos($_SERVER[‘HTTP_X_FORWARDED_PROTO’], ‘https’) !== false) $_SERVER[‘HTTPS’]=’on’;

Moving a WP Multisite to a subdirectory

I know it’s old but I fixed it! i installed WP MU in a subfolder. htaccess: RewriteEngine On RewriteBase /YOUR_SUBFOLDER RewriteRule ^index\.php$ – [L] # add a trailing slash to /wp-admin RewriteRule ^([_0-9a-zA-Z-]+/)?wp-admin$ $1wp-admin/ [R=301,L] RewriteCond %{REQUEST_FILENAME} -f [OR] RewriteCond %{REQUEST_FILENAME} -d RewriteRule ^ – [L] RewriteRule ^([_0-9a-zA-Z-]+/)?(wp-(content|admin|includes).*) $2 [L] RewriteRule ^([_0-9a-zA-Z-]+/)?(.*\.php)$ $2 [L] RewriteRule … Read more

Hata!: SQLSTATE[HY000] [1045] Access denied for user 'divattrend_liink'@'localhost' (using password: YES)