.htaccess Generator

What Is an .htaccess File?

An .htaccess file (the name is short for "hypertext access") is a per-directory configuration file read by the Apache web server. When Apache receives a request, it looks for an .htaccess file in the requested directory and applies any directives it finds, letting you change how the server behaves without touching the main httpd.conf configuration or restarting the server. Because of this, .htaccess is the standard way to configure Apache on shared hosting, where you usually do not have access to the global config.

The directives you can place in an .htaccess file cover a wide range of behavior: rewriting and redirecting URLs through mod_rewrite, sending HTTP response headers through mod_headers, compressing responses with mod_deflate, controlling browser caching with mod_expires, blocking access to sensitive files, and defining custom error pages. Many of these directives are wrapped in <IfModule> blocks so they are skipped safely if the relevant Apache module is not loaded, which is exactly how this generator structures its output.

How to Use This .htaccess Generator

Work through the option groups in the left panel and watch the generated file build itself in real time on the right. The Redirects section forces HTTPS, adds or removes the www prefix (these two are mutually exclusive), and enforces trailing slashes. The Security section blocks dotfiles like .env and .git, disables directory listing, hides the server signature, and adds hardening headers such as X-Frame-Options, X-Content-Type-Options, HSTS, and a referrer policy. The Performance section enables GZIP compression, sets browser-caching Expires headers, and removes ETags. You can also turn on CORS (with an optional custom origin), add as many 301/302 custom redirects as you need, and define custom 404, 403, and 500 error pages.

To move quickly, use the preset buttons: "Security Preset" ticks the recommended hardening options, "Performance Preset" enables the speed options, and "Everything" turns on every safe rule at once. When the output looks right, click Copy to grab the whole file, then save it as .htaccess in your site's directory. "Reset All" clears every option to start over.

Real-World Use Cases

• Forcing HTTPS site-wide — Redirect every HTTP request to HTTPS so visitors and search engines always use the secure version of your site.
• Hardening a site's security — Add clickjacking, MIME-sniffing, and HSTS headers and block access to hidden files in one step with the security preset.
• Speeding up page loads — Enable GZIP compression and long-lived cache headers so browsers download less and revisit assets from cache.
• Migrating old URLs — Add 301 redirects from retired paths to their new locations so links and rankings are preserved after a site restructure.
• Branded error pages — Point 404, 403, and 500 errors at your own designed pages instead of Apache's plain defaults.

Tips for Writing .htaccess Rules

• Always back up your existing .htaccess before replacing it; a single bad directive can return a 500 error for the whole directory.
• Set HSTS only once you are confident HTTPS works everywhere, because browsers will refuse plain HTTP for the duration of the max-age you specify.
• Choose www or non-www as your canonical host and redirect the other consistently — running both splits your SEO signals.
• Use 301 (permanent) redirects for moves that are final and 302 (temporary) only when the original URL will return.
• Test changes on a staging copy or low-traffic page first, since Apache applies .htaccess immediately to every request in that directory.

Features

• HTTPS and www redirects — Force HTTPS, add or strip www, and enforce trailing slashes.
• Security headers — Generate X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, Referrer-Policy, and HSTS inside an <IfModule mod_headers.c> block.
• File and listing protection — Block dotfiles, disable directory listing, and hide the server signature.
• Performance rules — Enable GZIP compression, Expires caching headers, and ETag removal.
• CORS support — Add cross-origin headers with a wildcard or a custom origin.
• Custom redirects and error pages — Add unlimited 301/302 redirects and set 404, 403, and 500 pages.
• Presets and live preview — One-click security, performance, or everything presets with instant output.
• 100% client-side — Your data never leaves your browser.

Frequently Asked Questions

Where do I put the .htaccess file?

Save the generated rules in a file named exactly .htaccess (with the leading dot and no extension) and place it in the directory you want it to govern, usually your site's root alongside index.html or index.php. The rules then apply to that directory and every subdirectory beneath it, unless a nested .htaccess overrides them.

Does .htaccess work on Nginx?

No. The .htaccess mechanism is specific to the Apache web server. Nginx does not read per-directory configuration files; instead you add equivalent directives to your nginx.conf or the relevant server block and reload the configuration. The concepts (redirects, headers, caching) carry over, but the syntax is completely different.

Will an .htaccess file slow my site down?

Apache reads and parses the .htaccess file on every request, so on very high-traffic sites there is a small overhead, and the recommended approach is to move the rules into the main server configuration where they are loaded once. For typical websites the impact is negligible and the convenience of per-directory configuration outweighs it.

What does "Force HTTPS" actually do?

It adds a mod_rewrite rule that checks whether the request arrived over plain HTTP and, if so, issues a 301 redirect to the same URL on https://. This ensures visitors and search engines always land on the encrypted version of your pages, which is important for both security and SEO.

What is HSTS and should I enable it?

HSTS (HTTP Strict Transport Security) sends a header telling browsers to only ever connect to your site over HTTPS for a set period, preventing downgrade and cookie-hijacking attacks. Enable it only after HTTPS is fully working across your whole site, because the policy is cached by the browser for the entire max-age and cannot be easily undone once sent.

Why are the rules wrapped in IfModule blocks?

Directives like header, compression, and caching rules depend on specific Apache modules (mod_headers, mod_deflate, mod_expires). Wrapping them in <IfModule> tags means Apache only runs them when the module is available and silently skips them otherwise, so your site will not crash with a 500 error on a server where a module is not installed.