What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Regenerate WordPress’s rewrite rules, keep folder authentication outside the WordPress-managed block, and make sure the protected directory does not collide with a permalink slug. On Apache, pretty permalinks normally depend on .htaccess and mod_rewrite. On Nginx, the equivalent rules belong in the server block because Nginx does not use per-directory .htaccess files.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
A password-protected folder can expose a rewrite problem without being the only cause. The usual failures are a 404 when rewrite rules are missing or bypassed, a 500 when .htaccess is malformed, or an authentication response for a path that WordPress was expected to route virtually. The sequence below separates those cases and repairs them without discarding custom redirects.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Start with the symptom: 404, 500, or an authentication prompt
Identify the response before changing configuration. The status code determines whether you should regenerate rules, remove a syntax error, or examine the protected path itself.
| What you see | Most likely explanation | First action |
|---|---|---|
Pretty URLs return 404, while the home page or /index.php works |
Rewrite rules are missing, stale, disabled, or not being read by the server | Confirm the server type, then save Settings > Permalinks to regenerate the WordPress rules |
| Every request, or the dashboard, returns 500 Internal Server Error | A malformed or incompatible .htaccess directive is being parsed |
Rename the file temporarily, restore access, and regenerate a clean file |
| Only URLs beneath one folder prompt for credentials or fail after login | The folder’s authentication rules, path, or permissions are wrong | Inspect that folder’s configuration and keep authentication outside the WordPress marker block |
| A slug fails only when it matches a real directory name | Apache’s existing-directory condition lets the physical folder intercept the request | Rename the folder or change the permalink slug, then regenerate and retest |
Do not repeatedly edit the file while the symptom is unclear. Each change can hide the original cause and can overwrite redirects that are unrelated to WordPress.
#1 Best Overall
How WordPress permalinks and a protected folder interact
With “pretty” permalinks, a request such as /guides/example-post/ is usually not a real file. Apache receives it, reads the site’s rewrite configuration, and sends requests that are not existing files or directories to index.php. WordPress then decides which post, page, archive, or other route should answer.
The standard Apache pattern contains two important conditions:
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-dThe first condition excludes a real file. The second excludes a real directory. That is why a physical directory can take precedence over a virtual WordPress URL. If a folder named guides exists at the document root, a request for /guides/ may be handled as a directory instead of being sent to WordPress. Adding Basic Authentication to that folder makes the distinction visible: visitors may see a login challenge, a directory-level 404, or a denial before WordPress runs.
Password protection does not inherently require disabling permalinks. The safe design is to let WordPress own its rewrite section and let the folder’s authentication configuration protect only the intended directory. Mixing both jobs in one managed section is what makes repairs fragile.
Back up the configuration before touching it
Make a copy of the existing .htaccess before renaming, editing, or regenerating it. Include hidden files in the file manager, or download the file through your hosting control panel. Keep the copy outside the web root when possible.
The backup matters because the file may contain more than WordPress’s generated block:
- Permanent redirects from old URLs.
- Rules for a front-end application, API, cache, or security layer.
- Directory-specific access controls.
- Compression, headers, or other host-provided settings.
Save the original as a versioned copy, such as .htaccess.before-permalink-repair. Do not leave several files beginning with .htaccess in the document root and assume Apache will choose the right one; only the active filename is read as configuration.
Confirm whether the site runs Apache or Nginx
The repair path is different on the two common web servers.
| Server | Where rewrite rules live | What to do |
|---|---|---|
| Apache | The site’s .htaccess, provided overrides and mod_rewrite are enabled |
Use Settings > Permalinks to regenerate rules, or repair the file manually after preserving custom directives |
| Nginx | The virtual-host or server-block configuration | Do not add Apache directives to .htaccess; ask the host or administrator to correct the server block and reload Nginx |
Your hosting panel may identify the server, or support can confirm it. A site can also use a proxy in front of Apache or Nginx, so identify the server that actually serves the WordPress document root.
Apache prerequisites
Apache must have mod_rewrite available, and the document-root directory must permit the relevant overrides. If overrides are disabled, a perfectly formed .htaccess has no effect. Ask the host to enable rewrite support and permit the required directory overrides rather than adding directives that the server is configured to reject.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Nginx prerequisites
Nginx does not process per-directory .htaccess files. Its equivalent routing is declared in the server block. A common shape is:
location / {
try_files $uri $uri/ /index.php?$args;
}The exact PHP handler, document root, and security rules depend on the host. Treat this as a structural example, not a complete Nginx site configuration. A hosting administrator should validate the full block and reload Nginx after the change.
Regenerate WordPress rules from the dashboard
On an Apache site where the dashboard is available, this is the least invasive repair.
- Open Settings > Permalinks in WordPress.
- Note the currently selected permalink structure. Do not change it unless you intend to change every public URL.
- Click Save Changes, even if you did not alter the selection. WordPress will attempt to write the appropriate rewrite rules.
- Open a new private-browser window and test the home page, a post, a page, and a URL below the protected folder.
If WordPress reports that it cannot update .htaccess, do not make the entire site broadly writable as a permanent fix. Preserve the current file, have the host correct ownership or directory overrides, and then save the permalink settings again.
Saving the page does not repair an Nginx configuration, and it cannot overcome disabled Apache rewrite support. It only regenerates the rules WordPress is responsible for writing.
Recover from a 500 error caused by .htaccess
A malformed .htaccess can prevent Apache from serving the site at all. WordPress documentation identifies a corrupted file as a likely cause of an internal-server error.
- Use your hosting file manager, SFTP, or SSH to locate the document-root
.htaccess. - Rename it to a temporary name such as
.htaccess.disabled. Renaming preserves the contents for review while stopping Apache from parsing that filename. - Request the home page. If the 500 disappears, the renamed file or one of its directives was involved.
- Open Settings > Permalinks and click Save Changes to create a fresh WordPress block.
- Restore custom redirects and other non-WordPress directives from the backup one group at a time, testing after each group.
If the site still returns 500 with the file renamed, the cause is elsewhere: a PHP error, a host-level rule, a plugin, or another server configuration. Renaming .htaccess is a diagnostic step, not proof that every 500 is a permalink problem.
Manually restore the standard WordPress block
Manual editing is appropriate when you have a verified backup, access to the correct document root, and a reason not to use the dashboard. Keep all custom directives outside the generated markers.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #4
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPressThis root-level example assumes WordPress is installed at the domain root. A site installed in a subdirectory needs paths that match that installation; copying the root example unchanged can create new failures. If you are unsure of the installation path, regenerate through WordPress or ask the host to supply the correct block.
Do not delete redirects simply to make the generated block look clean. Put redirects before or after the WordPress markers as appropriate, retain their conditions, and test both the old and new URLs.
Add password protection without breaking rewrites
Best location for a folder-specific rule
For a directory such as /private/, place its Basic Authentication directives in that directory’s own configuration when the host permits it. A typical Apache pattern is:
AuthType Basic
AuthName "Restricted area"
AuthUserFile /absolute/path/outside-the-web-root/.htpasswd
Require valid-userThe password-file path must be the real absolute path on your server, and the host must permit authentication directives in that directory. Never publish the password file inside a web-accessible location. Hosting providers may require you to create the account through their control panel instead of writing these directives yourself.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsIf authentication is in the root .htaccess
Keep the authentication directives outside # BEGIN WordPress and # END WordPress. WordPress may replace everything inside those markers the next time permalink settings are saved. A folder-specific rule placed in the managed block can therefore disappear without warning.
After adding protection, test both cases: an unauthenticated request should receive the intended authentication challenge, and a valid login should reach the expected file or application. A successful login does not prove that WordPress routing is correct; test a normal public permalink separately.
Best Value
Check for a directory-and-slug collision
Compare every protected folder name with your intended permalink slugs. If a physical directory and a virtual route use the same path segment, Apache may stop at the directory because the standard rewrite conditions explicitly exempt existing directories.
Resolve the collision
- Rename the physical folder to a name that is not used by public permalinks.
- Change the page or post slug, then update internal links and redirects.
- Keep private assets under a clearly reserved path and do not create public content beneath that path.
After changing either name, save the permalink settings again and test the old URL, the new URL, the directory itself, and an asset inside the protected folder. A redirect may be preferable for a public slug that has already been indexed.
Set permissions conservatively
When Apache uses mod_rewrite permalinks, WordPress may need to write .htaccess while you save permalink settings. That does not mean the whole web root should be writable by the web-server account.
- Use the narrowest ownership and permission change that lets WordPress update the file.
- Ask the host to correct ownership or enable the required override instead of applying broad write access.
- After regeneration, remove temporary write access if your hosting model allows it.
- Review who can edit the protected folder and its authentication file.
Broad write access can let an attacker modify configuration and take control of the site. A successful permalink repair that leaves the document root writable is not a safe repair.
Test the repair with a representative matrix
Use a private browser window or a client that has no saved credentials. Test each URL after every major configuration change.
| Test | Expected result | If it fails |
|---|---|---|
| Home page | Loads normally over the expected scheme and host | Check broader server, PHP, or redirect configuration |
| One published post | Pretty permalink resolves to the post, not a 404 | Regenerate rules and verify rewrite support |
| One published page | Page route resolves normally | Check for a page slug that matches a physical directory |
| Asset inside the protected folder | Unauthenticated request receives the intended authentication response; authenticated request can access the asset | Inspect folder authentication, password-file path, and permissions |
| Public URL near the protected folder | Unaffected public content still routes through WordPress | Look for an over-broad directory rule or path collision |
| Old redirected URL | Custom redirect still reaches its destination | Restore the redirect from the backup outside the managed block |
Check the response status and the final URL, not just what appears in a browser. A cached 404 or a remembered Basic Authentication session can make a fixed configuration look broken.
Troubleshoot by failure branch
Pretty permalinks still return 404 after saving
- Confirm the request is reaching the correct document root.
- Verify that the site is Apache if you are editing
.htaccess. - Ask the host whether
mod_rewriteand directory overrides are enabled. - Check that the generated file is writable by WordPress and that the save operation actually completed.
- Look for a physical directory with the same path as the failing slug.
The site returns 500 immediately after adding protection
- Rename the active
.htaccessto confirm whether Apache parsing is involved. - Check for directives the host does not permit in that directory.
- Verify the authentication-file path and syntax supplied by the host.
- Regenerate the WordPress block, then add the authentication configuration outside its markers.
The password prompt never appears
- Confirm the request is actually under the protected directory.
- Check whether the host permits authentication directives in that location.
- Ensure the authentication rule is not inside a block WordPress will overwrite.
- Test without cached credentials and verify that the password file is readable by the server but not publicly downloadable.
The dashboard cannot be reached to save permalinks
Use the file manager or SFTP to preserve and temporarily rename the active .htaccess, then restore access and save the permalink settings. If the dashboard remains unavailable after the file is renamed, investigate the separate application or server error rather than repeatedly changing rewrite rules.
Prevent the next permalink outage
- Keep a dated backup of
.htaccessbefore migrations, folder renames, and security changes. - Reserve a naming convention for private directories so they cannot accidentally become public slugs.
- Document which rules are generated by WordPress and which are custom.
- Make one configuration change at a time and test a post, a page, a protected asset, and an unauthenticated request.
- Have the host confirm whether the site uses Apache or Nginx before following a server-specific guide.
- Review permissions after every successful regeneration.
The reliable repair pattern
Back up the configuration, identify the server, classify the status code, regenerate WordPress’s rules, and keep Basic Authentication outside the WordPress-managed markers. On Apache, also verify mod_rewrite, directory overrides, and the ability to write .htaccess. On Nginx, correct the server block instead. Finally, remove any physical-directory collision and test public, protected, authenticated, and redirected URLs separately.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
