WordPress Index.php: WordPress index.php vs .htaccess for Understanding Website Entry Files

Published On -

Sophia Willson blog

The fastest way to understand WordPress routing is this: index.php is the main WordPress entry file, while .htaccess is usually the traffic director that decides when requests should reach it. If your site uses Apache and pretty permalinks, both files matter. If one is missing or messy, your homepage may load while posts, pages, images, or admin URLs throw ugly errors. WordPress runs over 40% of all websites, so this tiny pair of files causes a huge amount of support pain across the web [source: W3Techs].

TLDR: index.php boots WordPress and loads the theme, plugins, database queries, and routing logic. .htaccess sits one step earlier on Apache servers and rewrites friendly URLs like /about/ into a request WordPress can process. For example, if a site has 300 blog posts and 92% of traffic lands on article URLs, a broken .htaccess file can make most real visitors hit 404 pages while the homepage still looks fine. A common user case: a store owner changes permalink settings, sales drop 18% overnight, and the real problem is a missing rewrite rule.

What index.php Does in WordPress

The index.php file in a WordPress root folder is small, but it starts a big chain reaction. Open a standard copy and you will usually see just a few lines. It defines that the request should use WordPress themes, then loads wp-blog-header.php. That file brings in the rest of WordPress.

Think of index.php as the front counter at a busy office. It does not answer every question itself. It calls the right people, checks the system, and sends the request where it belongs.

Once WordPress is loaded, it can:

  • Read the requested URL.
  • Match it to a post, page, category, feed, or custom route.
  • Load active plugins.
  • Pick the correct theme template.
  • Send the final HTML back to the visitor.

If index.php is deleted, renamed, or filled with bad code, the site may fail completely. You may see a blank page, a 500 error, or a file download prompt. None of those are fun. Honestly, it feels like the site is fine one second, then one three-line file ruins your afternoon.

What .htaccess Does

The .htaccess file is different. It is not a WordPress boot file. It is an Apache server configuration file. WordPress writes to it when you save permalink settings, assuming file permissions allow that. Apache then reads those rules before WordPress gets involved.

The most famous WordPress block looks similar to this:

# BEGIN WordPress
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
# END WordPress

That block says, in plain English: if the request is not for a real file or folder, send it to index.php. So /contact/ does not need a physical folder named “contact.” Apache passes that request to WordPress, and WordPress figures out which page to show.

Apache explains that .htaccess files allow directory-level configuration, though server-wide config is often faster when you control the server [source: Apache].

index.php vs .htaccess: The Simple Difference

Here is the clean split:

  • .htaccess acts before WordPress. It handles rewrite rules, redirects, access limits, and some caching or security headers.
  • index.php acts as WordPress starts. It loads the WordPress core and lets WordPress decide what content to show.
  • .htaccess belongs to the web server layer. It is mainly an Apache feature.
  • index.php belongs to the application layer. It is part of WordPress itself.

This matters because the same error can look similar from the outside. A broken permalink rule can show a 404. A damaged theme template can also show a 404. A deleted page can show one too. The trick is knowing which layer to check first.

Common Problems and What They Usually Mean

Use this quick guide when WordPress starts acting strange:

  • Homepage works, but posts return 404: suspect .htaccess or permalink settings.
  • Everything returns 500: suspect bad .htaccess, broken PHP, or server limits.
  • Only admin works: check theme files, caching rules, or plugin routing.
  • Pretty URLs fail, but plain URLs work: rewrite rules are likely missing.
  • Site downloads index.php instead of running it: PHP handling on the server is broken.

A very common fix is boring but effective. Go to Settings > Permalinks in WordPress admin and click Save Changes. You do not even need to change the structure. WordPress will try to refresh the rewrite rules. It drives me crazy that this tiny button can save 40 minutes of file checking, but it often does.

Why Pretty Permalinks Need Both Files

Plain WordPress URLs look like this:

example.com/?p=123

Pretty permalinks look like this:

example.com/best-coffee-grinders/

The second version is cleaner for readers. It is also easier to share and better for organizing content. But Apache needs rewrite rules to send that nice-looking URL to WordPress. That is where .htaccess helps. Then index.php takes over and WordPress looks up the right post.

Without the rewrite step, Apache may search for a real folder called best-coffee-grinders. If it does not exist, Apache may return a 404 before WordPress can help. That is why users often say, “My posts vanished,” even though the database is fine.

What Happens on Nginx Servers?

Not every WordPress site uses Apache. Many modern hosts use Nginx, or a mix of Nginx and Apache. Nginx does not use .htaccess. Its rewrite rules live in the server block configuration instead.

That means a missing .htaccess file may not matter at all on an Nginx-only setup. But index.php still matters. WordPress still needs a front entry file to load the application.

If your host says, “We do not support .htaccess,” do not panic. Ask where rewrite rules are managed. On managed WordPress hosting, this is often handled for you. On a VPS, you may need to edit the Nginx config and reload the service.

Security Notes for index.php and .htaccess

Attackers love files that run early. That makes both files worth protecting. A hacked index.php may inject spam links, redirect users, or load malicious scripts. A hacked .htaccess file may send mobile visitors to scam pages while desktop users see the normal site.

Watch for these signs:

  • Unknown redirects to gambling, crypto, or adult sites.
  • Strange code before or after the normal WordPress lines.
  • Rules that affect only Googlebot or mobile browsers.
  • Repeated changes after you clean the file.

Keep clean backups of both files. Also compare them against a fresh WordPress download. For most sites, index.php should be almost identical to the original WordPress version.

Best Practices for Editing These Files

Before editing either file, slow down. One bad character can break the site.

  • Make a backup first. Save copies as index.php.bak and htaccess.bak outside the public folder if possible.
  • Use SFTP or your host file manager. Avoid editing live files through random plugins.
  • Change one thing at a time. Test after each change.
  • Do not paste rules you do not understand. Redirect loops are painfully easy to create.
  • Keep custom rules outside the WordPress block. WordPress may overwrite anything between its markers.

The Practical Mental Model

Picture a visitor typing a URL. The server sees the request first. If Apache is in use, .htaccess may rewrite it. Then the request reaches index.php. WordPress loads, checks the database, chooses a template, and sends the page.

So the answer is not “index.php or .htaccess.” It is usually both, in order. .htaccess gets the request to the right doorway. index.php opens the WordPress building. Once you see that flow, permalink errors, 404 pages, and redirect issues become much less mysterious.