Posts

Reduce unwanted image hotlinking without blocking your CDN, search previews, feeds, partners or visitors who send no Referer header.

Block access to xmlrpc.php only after confirming that Jetpack, mobile publishing and other remote clients do not depend on it.

Deny web access to wp-config.php and remove downloadable backup copies while preserving normal WordPress bootstrap access.

Disable Apache directory indexes without blocking legitimate WordPress media and static files.

Diagnose WordPress permalink 404s by comparing query-style URLs, rewrite rules, document roots and Apache override support.

Choose one canonical WordPress hostname and write an exact .htaccess redirect that preserves paths without creating loops.

Force HTTPS in WordPress only after TLS is ready, with one redirect owner and proxy-aware scheme detection.

Create an identifiable .htaccess backup and prove that it can restore both site access and the rules the file protects.

Recover from a WordPress 500 error by restoring the last known-good .htaccess file and using the server log to identify the failed directive.

Find why WordPress cannot write .htaccess and restore only the access required by the hosting or deployment model.