I have been reading about File Permissions in Hardening WordPress on wordpress.org

When it comes to .htaccess, the guide currently says

The root WordPress directory: all files should be writable only by your user account, except .htaccess if you want WordPress to automatically generate rewrite rules for you.

but it does not specify what permissions .htaccess is supposed to have. SE's own How to to secure WordPress file and folder permissions does not address this question either and the accepted answer just points to the link above I already visited (other answers don't address this either).

I am assuming that what they mean by 'should be writable only by your user account, except .htaccess ' is that .htaccess should also be writable by the web server account.

Is that the case?

If that helps I'm on Debian (11) + Apache 2.4.56

1 Answer 1


It might be useful to let the web server write .htaccess during initial site setup, e.g. when you're setting up rewrite rules (as it said) or if you're setting up a multisite network. Once you've done that though it no longer needs to edit the file so it would make sense to secure it the same as you would the other files in the root folder.

However if WordPress can't write .htaccess itself then it will tell you what edits to make and give you lines to paste in, so it's not a big deal if you don't ever give it write access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.