Default .htaccess file for WordPress, Joomla, OpenCart and other CMS

If a site suddenly shows error 500, a redirect loop, or 404 on every page except the home page, a damaged .htaccess file is a likely cause. The fix is to put back the default rules of your CMS. This article gives those rules for WordPress, Joomla, OpenCart and Bitrix, explains where Drupal, PrestaShop and Magento keep theirs, and shows how to swap the file in cPanel without losing anything important.

What .htaccess does and when it breaks

.htaccess is a small text file in the site folder that tells the web server how to handle requests: rewriting readable addresses to index.php, redirecting to HTTPS, blocking access to some files. The same rules work on Web Hosting SSD (Nginx and Apache) and on WordPress Hosting and Business Hosting, where the LiteSpeed web server reads .htaccess in the same way.

The file usually breaks in one of these situations:

• a cache, security or redirect plugin wrote rules that do not work together;
• someone edited the file by hand and left a typo;
• old PHP lines such as php_flag or php_value remained after a PHP change;
• the site was hacked and the file now sends visitors to another site.

How to replace the file safely in cPanel

1. In cPanel open File Manager. Click Settings at the top right, tick Show Hidden Files (dotfiles) and save. Files whose name starts with a dot are hidden otherwise.
2. Open the site folder: public_html for the main domain, or the folder chosen when the domain was added (shown in Domains as Document Root).
3. Right-click .htaccess and rename it to .htaccess.old. This keeps a copy you can go back to.
4. Click + File, name it .htaccess and create it. Right-click the new file, choose Edit, paste the rules for your CMS from below and click Save Changes.
5. Open the site in a private browser window and check the home page and a few inner pages.
6. Look in .htaccess.old for blocks you still need and copy them, unchanged, into the new file (see the next section). When everything works, delete the old copy.

Blocks worth keeping from the old file

• The cPanel PHP handler. A block marked # php -- BEGIN cPanel-generated handler, do not edit sets the PHP version chosen in MultiPHP Manager. Without it the site may run on another PHP version. Copy it as it is.
• Your HTTPS or www redirect. If you made one, put it back at the top of the file, or rebuild it as shown in Redirects from http to https and www with .htaccess.
• The LiteSpeed Cache block on WordPress Hosting and Business Hosting. You do not need to copy it: the plugin writes it again when you save its settings (see Turning on LiteSpeed Cache for WordPress).

Do not carry over php_flag or php_value lines. Change PHP settings in cPanel instead, as described in PHP version selection.

WordPress

These are the default rules of a WordPress site installed directly on the domain:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

If WordPress lives in a folder, for example example.md/blog, write RewriteBase /blog/ and RewriteRule . /blog/index.php [L]. A quicker way to rewrite this block is to open Settings, then Permalinks in WordPress and click Save without changing anything. If inner pages still return 404, see Common WordPress problems and how to fix them.

Joomla

Joomla keeps its full rule set in the file htaccess.txt in the site folder. The simplest fix is to copy that file's content into .htaccess. If htaccess.txt is gone, this core part is enough for readable addresses and basic protection:

Options +SymLinksIfOwnerMatch
Options -Indexes
RewriteEngine On
RewriteCond %{QUERY_STRING} base64_encode[^(]*\([^)]*\) [OR]
RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule .* index.php [F]
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteCond %{REQUEST_URI} !^/index\.php
RewriteCond %{REQUEST_URI} /component/|(/[^.]*|\.(php|html?|feed|pdf|vcf|raw))$ [NC]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule .* index.php [L]

For a Joomla site in a folder add RewriteBase /folder-name after RewriteEngine On. In Joomla, the option Use URL Rewriting in Global Configuration must be on for these rules to be used.

OpenCart

OpenCart ships its rules as .htaccess.txt; renaming that file is usually all you need. The essential part looks like this:

Options -Indexes
RewriteEngine On
RewriteBase /
RewriteRule ^system/storage/(.*) index.php?route=error/not_found [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !.*\.(ico|gif|jpg|jpeg|png|webp|svg|js|css)
RewriteRule ^([^?]*) index.php?_route_=$1 [L,QSA]

For a shop in a folder, change RewriteBase / to RewriteBase /shop/. The readable links also need Use SEO URLs turned on in the store settings (see Install OpenCart in cPanel).

1C-Bitrix

Options -Indexes
ErrorDocument 404 /404.php
<IfModule mod_rewrite.c>
Options +SymLinksIfOwnerMatch
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-l
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !/bitrix/urlrewrite.php$
RewriteRule ^(.*)$ /bitrix/urlrewrite.php [L]
RewriteRule .* - [E=REMOTE_USER:%{HTTP:Authorization}]
</IfModule>
<IfModule mod_dir.c>
DirectoryIndex index.php index.html
</IfModule>

Older Bitrix files also contained php_flag lines (for example allow_call_time_pass_reference). Those settings no longer exist in current PHP and can cause error 500, so leave them out.

Drupal, PrestaShop and Magento

• Drupal has a long .htaccess that changes between versions. Do not write it by hand: download the archive of your exact Drupal version from drupal.org and take the file from it. Old snippets with magic_quotes_gpc or register_globals belong to PHP versions that are long gone.
• PrestaShop generates the file itself. In the administration go to Shop Parameters, then Traffic & SEO, check that Friendly URL is on and save: the file is written again. More in How to get PrestaShop running from cPanel.
• Magento keeps .htaccess files in the root and in the pub folder. Take them from the package of the same Magento version (see Installing Magento with Softaculous in cPanel).

If the site still does not work

• Error 500 right after saving. Most often an Options line the server does not allow, or a typo. Put a # in front of the Options lines and reload. The exact reason is in cPanel under Metrics, then Errors. See also HTTP 500 or 503 on your site: causes and fixes.
• The file keeps changing back. A plugin rewrites it, or the site is infected. Check the .htaccess files in subfolders too (for WordPress, wp-content and wp-content/uploads), and follow There are viruses on my site, what should I do?
• Too many redirects. Two rules redirect to each other, often HTTPS rules from a plugin and from the file at the same time. Keep only one.

Need help? Open a ticket with the domain and tell us which CMS the site uses; we can compare the file with a backup copy.

Related articles

• Redirects from http to https and www with .htaccess
• Restoring a site or single files with JetBackup 5
• Common WordPress problems and how to fix them