ClassicPress .htaccess Hacks for Performance and Security

The following .htaccess directives can help to boost your ClassicPress performance and security. Your existing `.htaccess` file may contain some of these directives already, so, feel free to pick and choose only those that you want. Before adding any directives. head on over to GTMetrix and get your site’s baseline scores – later, after you’ve applied the various directives, you can retest your site to see the improvements in actual numbers.

Getting Started

Make a copy of your existing `.htaccess` file to get started. With the directives below, don’t just do a straight copy/paste! Instead, add one complete directive at a time, refreshing your site in a browser each time to ensure that an Error 500 didn’t occur. If an error did occur, you can delete (or amend) the directive you just added. There are a couple of places where you need to add your own URL, so, be sure to see the comments above each directive.

.htaccess Hacks for ClassicPress

# Default error messages for when someone accesses a blocked file.
ErrorDocument 401 "Denied"
ErrorDocument 403 "Denied"

# Require authentication before accessing wp-login.php
# Note that you will need to point the path to your own .htpasswd file that
# contains the http auth credentials.
<Files wp-login.php>
AuthType Basic
AuthName "Secure Area"
AuthUserFile "/home/path/to/.htpasswd"
require valid-user
</Files>

# Prevent access to .htaccess file.
<files ~ "^.*\.([Hh][Tt][Aa])">
order allow,deny
deny from all
satisfy all
</files>

# Prevent access to xmlrpc.php
<Files xmlrpc.php>
order deny,allow
deny from all
</Files>

# Prevent access to wp-config.php
<files wp-config.php>
order allow,deny
deny from all
</files>

# Enable strict HTTPS transport; not the same as forcing connections to HTTPS.
# There is another directive below for that.
Header set Strict-Transport-Security "max-age=86400" env=HTTPS

# Ensure a strict character set for certain types.
AddDefaultCharset utf-8
<IfModule mod_mime.c>
	AddCharset utf-8 .appcache \
		 .bbaw \
		 .css \
		 .htc \
		 .ics \
		 .js \
		 .json \
		 .manifest \
		 .map \
		 .markdown \
		 .md \
		 .mjs \
		 .svg \
		 .topojson \
		 .vtt \
		 .vcard \
		 .vcf \
		 .webmanifest \
		 .xloc
</IfModule>

# Ensure proper mimetypes; prevent browser sniffs in case of issues.
<IfModule mod_mime.c>
	AddType application/atom+xml atom
	AddType application/json json map topojson
	AddType application/ld+json jsonld
	AddType application/rss+xml rss
	AddType application/geo+json geojson
	AddType application/rdf+xml rdf
	AddType application/xml xml
	AddType text/javascript js mjs
	AddType application/manifest+json webmanifest
	AddType application/x-web-app-manifest+json webapp
	AddType text/cache-manifest appcache
	AddType audio/mp4 f4a f4b m4a
	AddType audio/ogg oga ogg opus
	AddType image/bmp bmp
	AddType image/svg+xml svg svgz
	AddType image/webp webp
	AddType video/mp4 f4v f4p m4v mp4
	AddType video/ogg ogv
	AddType video/webm webm
	AddType video/x-flv flv
	AddType image/x-icon cur ico
	AddType application/wasm wasm
	AddType font/woff woff
	AddType font/woff2 woff2
	AddType application/vnd.ms-fontobject eot
	AddType font/ttf ttf
	AddType font/collection ttc
	AddType font/otf otf
	AddType application/octet-stream safariextz
	AddType application/x-bb-appworld bbaw
	AddType application/x-chrome-extension crx
	AddType application/x-opera-extension oex
	AddType application/x-xpinstall xpi
	AddType text/calendar ics
	AddType text/markdown markdown md
	AddType text/vcard vcard vcf
	AddType text/vnd.rim.location.xloc xloc
	AddType text/vtt vtt
	AddType text/x-component htc
</IfModule>
<IfModule mod_headers.c>
	Header set X-Content-Type-Options "nosniff"
	Header set Connection keep-alive
	ServerSignature Off
	Header always unset "X-Powered-By"
	Header unset "X-Powered-By"
	Header unset ETag
	FileETag None
</IfModule>

# Serve webp images, if possible.
<IfModule pagespeed_module>
	ModPagespeed on
	ModPagespeedEnableFilters convert_png_to_jpeg,convert_jpeg_to_webp
	ModPagespeedEnableFilters collapse_whitespace,remove_comments
</IfModule>

# Force HTTPS for all connections; be sure to change the URL to your own!
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://codepotent.com/$1 [R,L]

# Cross-origin resource sharing - for images.
<IfModule mod_setenvif.c>
	<IfModule mod_headers.c>
		<FilesMatch "\.(bmp|cur|gif|ico|jpe?g|png|svgz?|webp)$">
			SetEnvIf Origin ":" IS_CORS
			Header set Access-Control-Allow-Origin "*" env=IS_CORS
		</FilesMatch>
	</IfModule>
</IfModule>

# Cross-origin resource sharing - for fonts. 
<IfModule mod_headers.c>
	<FilesMatch "\.(eot|otf|tt[cf]|woff2?)$">
		Header set Access-Control-Allow-Origin "*"
	</FilesMatch>
</IfModule>
<IfModule mod_headers.c>
	Header set X-UA-Compatible "IE=edge"
	<FilesMatch "\.(appcache|atom|bbaw|bmp|br|crx|css|cur|eot|f4[abpv]|flv|geojson|gif|gz|htc|ic[os]|jpe?g|m?js|json(ld)?|m4[av]|manifest|map|markdown|md|mp4|oex|og[agv]|opus|otf|pdf|png|rdf|rss|safariextz|svgz?|swf|topojson|tt[cf]|txt|vcard|vcf|vtt|wasm|webapp|web[mp]|webmanifest|woff2?|xloc|xml|xpi)$">
		Header unset X-UA-Compatible
	</FilesMatch>
</IfModule>

# Enable server compression.
<IfModule mod_deflate.c>
	<FilesMatch "\.(html|php|txt|xml|js|css)$">
		SetOutputFilter DEFLATE
	</FilesMatch>
	<IfModule mod_setenvif.c>
		<IfModule mod_headers.c>
			SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding
			RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding
		</IfModule>
	</IfModule>
	<IfModule mod_filter.c>
		AddOutputFilterByType DEFLATE "application/atom+xml" \
			 "application/javascript" \
			 "application/json" \
			 "application/ld+json" \
			 "application/manifest+json" \
			 "application/rdf+xml" \
			 "application/rss+xml" \
			 "application/schema+json" \
			 "application/geo+json" \
			 "application/vnd.ms-fontobject" \
			 "application/wasm" \
			 "application/x-font-ttf" \
			 "application/x-javascript" \
			 "application/x-web-app-manifest+json" \
			 "application/xhtml+xml" \
			 "application/xml" \
			 "font/woff" \
			 "font/woff2" \
			 "font/eot" \
			 "font/opentype" \
			 "font/otf" \
			 "image/bmp" \
			 "image/svg+xml" \
			 "image/vnd.microsoft.icon" \
			 "text/cache-manifest" \
			 "text/calendar" \
			 "text/css" \
			 "text/html" \
			 "text/javascript" \
			 "text/plain" \
			 "text/markdown" \
			 "text/text" \
			 "text/vcard" \
			 "text/vnd.rim.location.xloc" \
			 "text/vtt" \
			 "text/x-component" \
			 "text/x-cross-domain-policy" \
			 "text/xml"
	</IfModule>
	<IfModule mod_mime.c>
		AddEncoding gzip svgz
	</IfModule>
</IfModule>

# Add expires headers.
<IfModule mod_expires.c>
	ExpiresActive on
	ExpiresDefault "access plus 1 month"
	ExpiresByType text/css "access plus 1 year"
	ExpiresByType application/atom+xml "access plus 1 hour"
	ExpiresByType application/rdf+xml "access plus 1 hour"
	ExpiresByType application/rss+xml "access plus 1 hour"
	ExpiresByType application/json "access plus 0 seconds"
	ExpiresByType application/ld+json "access plus 0 seconds"
	ExpiresByType application/schema+json "access plus 0 seconds"
	ExpiresByType application/geo+json "access plus 0 seconds"
	ExpiresByType application/xml "access plus 0 seconds"
	ExpiresByType text/calendar "access plus 0 seconds"
	ExpiresByType text/xml "access plus 0 seconds"
	ExpiresByType image/vnd.microsoft.icon "access plus 1 week"
	ExpiresByType image/x-icon "access plus 1 week"
	ExpiresByType text/html "access plus 0 seconds"
	ExpiresByType application/javascript "access plus 1 year"
	ExpiresByType application/x-javascript "access plus 1 year"
	ExpiresByType text/javascript "access plus 1 year"
	ExpiresByType application/manifest+json "access plus 1 week"
	ExpiresByType application/x-web-app-manifest+json "access plus 0 seconds"
	ExpiresByType text/cache-manifest "access plus 0 seconds"
	ExpiresByType text/markdown "access plus 0 seconds"
	ExpiresByType audio/ogg "access plus 1 month"
	ExpiresByType image/bmp "access plus 1 month"
	ExpiresByType image/gif "access plus 1 month"
	ExpiresByType image/jpeg "access plus 1 year"
	ExpiresByType image/png "access plus 1 month"
	ExpiresByType image/svg+xml "access plus 1 month"
	ExpiresByType image/webp "access plus 1 month"
	ExpiresByType video/mp4 "access plus 1 month"
	ExpiresByType video/ogg "access plus 1 month"
	ExpiresByType video/webm "access plus 1 month"
	ExpiresByType application/wasm "access plus 1 year"
	ExpiresByType font/collection "access plus 1 month"
	ExpiresByType application/vnd.ms-fontobject "access plus 1 month"
	ExpiresByType font/eot "access plus 1 month"
	ExpiresByType font/opentype "access plus 1 month"
	ExpiresByType font/otf "access plus 1 month"
	ExpiresByType application/x-font-ttf "access plus 1 month"
	ExpiresByType font/ttf "access plus 1 month"
	ExpiresByType application/font-woff "access plus 1 month"
	ExpiresByType application/x-font-woff "access plus 1 month"
	ExpiresByType font/woff "access plus 1 month"
	ExpiresByType application/font-woff2 "access plus 1 month"
	ExpiresByType font/woff2 "access plus 1 month"
	ExpiresByType text/x-cross-domain-policy "access plus 1 week"
	ExpiresByType text/x-component A31536000
	ExpiresByType text/x-js A31536000
	ExpiresByType text/richtext A3600
	ExpiresByType text/plain A3600
	ExpiresByType text/xsd A3600
	ExpiresByType text/xsl A3600
</IfModule>

# Prevent directory listing.
Options -Indexes

# Block access to other potentially sensitive files.
<IfModule mod_rewrite.c>
	RewriteEngine On
	RewriteCond %{REQUEST_URI} "!(^|/)\.well-known/([^./]+./?)+$" [NC]
	RewriteCond %{SCRIPT_FILENAME} -d [OR]
	RewriteCond %{SCRIPT_FILENAME} -f
	RewriteRule "(^|/)\." - [F]
</IfModule>
<IfModule mod_authz_core.c>
	<FilesMatch "(^#.*#|\.(bak|conf|dist|fla|in[ci]|log|orig|psd|sh|sql|sw[op])|~)$">
		Require all denied
	</FilesMatch>
</IfModule>

How did it go?

Did you have trouble with any of the directives? How did your performance scores change? Do you know any other `.htaccess` directives that can improve performance and security? I’d love to hear your thoughts – let me know in the comments!