.htaccess for WordPress: security and redirects

Force HTTPS

Rewrite rules can redirect HTTP to HTTPS at the edge of Apache. Test carefully to avoid redirect loops.

Protect sensitive files

Block direct access to wp-config.php or backup archives where your server allows it.