Home›Developer Tools›.htaccess Generator
⚙️

Apache .htaccess Generator

Build redirect, performance, security, access-control, and error-handling rules with validation and server-compatibility guidance.

Validated inputsPrivate builderApache 2.4 focused
Start with a preset:
↪Canonical URL & redirects
Redirect HTTP requests permanently to HTTPS.
Combine protocol and hostname into one redirect to avoid chains.
Redirect explicit /index.php requests to the containing directory.
Add exact old-to-new URL mappings.
⚡Performance
Set Expires rules for static assets.
Use Brotli when available, with GZIP as a module-safe fallback.
Add WebP and AVIF type mappings when mod_mime is available.
🛡️Security & privacy
Prevents Apache from generating file indexes.
Protect .env, logs, backups, VCS metadata and dotfiles.
Add nosniff, referrer policy, frame protection and permissions policy.
Tell browsers to use HTTPS. Enable only after HTTPS works across the entire domain.
Allow direct requests and your own domain, deny third-party embeds.
🚧Errors & access control
Use root-relative local paths or full URLs.
Choose an allow-only list or block listed addresses. Apache 2.4 syntax.
🔧Advanced server options
These php_value rules often cause HTTP 500 with PHP-FPM. Prefer php.ini or hosting controls when available.
Advanced users only. Custom text is included verbatim and cannot be validated.
Before deploying: keep a backup, upload as plain text named .htaccess, and test in a staging directory when possible. A syntax error can make the site return HTTP 500.
🧩

Module-safe blocks

Optional compression, cache, header, and MIME directives are guarded with IfModule where appropriate.

🔍

Validated rule inputs

Domains, paths, redirects, IP entries, and numeric PHP limits are checked before output is created.

⚠️

Compatibility guidance

The builder flags HSTS, PHP-FPM, custom directives, and host-level restrictions that require extra care.

How to deploy an .htaccess file safely

This file is read by Apache for the directory where it lives and usually its descendants. Hosting providers can disable individual directives or .htaccess overrides entirely.

Always keep a backup

Rename or download the existing file before replacement. If the site returns HTTP 500, restore it immediately.

Avoid redirect chains

Canonical hostname and HTTPS rules are combined here when both are enabled, reducing unnecessary redirect hops.

HSTS is persistent

Browsers remember it for the selected max age. Do not enable it until HTTPS works for every required hostname.

Apache only

Nginx, IIS, Caddy, and many managed platforms do not use .htaccess. Their configuration syntax is different.