🔧 .htaccess Generator

🎯 Preset

Select a curated starting point. The form fields below repopulate when you switch presets.

🔒 Force HTTPS

Redirect every http:// request to https:// with a 301.

🌐 www / non-www canonical

↪️ Redirects

No redirect rules. Click "Add redirect" to create one.

🔀 Custom Rewrites

No custom rewrite rules yet.

🛑 IP allow/deny

⚠️ Custom error pages

No custom ErrorDocument directives.

🗜️ Compression

⏱️ Browser cache headers

📁 Directory listing

🖼️ Hotlink protection

📝 Custom rules

📤 Generated .htaccess

{{ output || '# Toggle options on the left to generate rules.' }}

⚠️ Warnings

  • {{ w }}

📂 Generated sections

  • {{ s.name }} — {{ s.description }}
⚠️

ℹ️ About .htaccess Generator

What an .htaccess file does

An .htaccess file is a per-directory Apache configuration drop-in. When Apache serves a request, it walks the document root looking for .htaccess files in each directory along the path and merges their directives into the active configuration for that request. The format is the same as httpd.conf, but the directives that are allowed in an .htaccess file are gated by the AllowOverride setting on the parent <Directory> block — typically AllowOverride All on a shared host.

This generator builds a complete .htaccess for the most common site-level features: redirect HTTP to HTTPS, canonicalize www vs. non-www, run mod_rewrite rules, lock down IPs, serve custom error pages, enable mod_deflate / mod_brotli compression, set browser cache lifetimes via mod_expires and mod_headers, disable directory listings, and block image hotlinking. Every emitted block is wrapped in <IfModule> guards so the file does not break sites that lack a specific module.

Sections this generator can emit

  • Force HTTPS — RewriteEngine On + RewriteCond %{HTTPS} off + RewriteRule .* https://... with [R=301,L].
  • www / non-www canonical — single 301 that redirects bare apex to www. or vice versa. Combined with HSTS, this prevents duplicate-content SEO penalties.
  • Redirects — mod_alias Redirect 301 /old /new for path changes after a migration. Supports 301, 302, 303, 307, and 308 status codes.
  • Custom rewrites — free-form RewriteRule with PCRE pattern, target, and flag list (e.g. [L,R=301,NC]).
  • IP rules — Order deny,allow with Deny from 1.2.3.4 and Allow from 10.0.0.0/8. Supports IPv4, IPv6, and CIDR ranges.
  • Custom error pages — ErrorDocument 404 /404.html for any HTTP 4xx/5xx code.
  • GZIP compression — mod_deflate filter for HTML, CSS, JS, JSON, SVG, fonts. Skips already-compressed assets like JPEG/PNG/WebP/WOFF2.
  • Brotli compression — mod_brotli with BROTLI_COMPRESS output filter. Typically 15-25% smaller than gzip.
  • Browser cache — mod_expires + mod_headers with a long max-age for hashed static assets and a short max-age for HTML.
  • Directory listing — Options -Indexes hides the autoindex page that exposes file/directory names when no index document is present.
  • Hotlink protection — RewriteCond %{HTTP_REFERER} against an allow-list of domains; off-allow-list image requests get a 403 or a substitute image.
  • Custom rules — free-form trailer appended verbatim for anything the generator does not cover natively.

Mod_rewrite quick reference

RewriteRule takes a pattern (PCRE), a substitution string, and optional flags. Common flags:

  • L — last rule, stop processing further RewriteRules.
  • R=301 / R=302 — issue an external redirect with the given HTTP code.
  • NC — case-insensitive match.
  • QSA — append the query string from the original request.
  • F — forbidden, return 403.
  • G — gone, return 410.
  • NE — no-escape, keep % / ? / # verbatim in the substitution target.
  • E=VAR:value — set an environment variable for subsequent rules.

RewriteCond applies an extra precondition to the next RewriteRule — for example RewriteCond %{HTTP_HOST} ^example\\.com$ limits the rule to one virtual host. See httpd.apache.org/docs/2.4/mod/mod_rewrite.html for the full reference.

Common pitfalls

  • Redirect loops — redirecting / to itself, or chaining a force-www rule with a non-www rule, will loop until the browser gives up. The generator warns when a redirect target equals its source or when the source is /.
  • Aggressive HTML caching — Cache-Control: max-age=86400 on HTML will keep stale pages in browsers and CDNs for a day. Use minutes, not days, for HTML.
  • Hotlink false positives — empty Referer headers (mobile data savers, privacy extensions, direct loads) match an allow-list condition only if you allow empty referers. The generator emits RewriteCond %{HTTP_REFERER} !^$ first so empty referers pass.
  • Hosts without mod_rewrite — every rewrite block is wrapped in <IfModule mod_rewrite.c> so directives are silently ignored if the module is absent. You still need RewriteEngine On inside each block.
  • Override is required — for .htaccess to be read at all, the parent <Directory> in httpd.conf must have AllowOverride All (or at least the relevant subset like FileInfo for Redirect).

When to use Nginx instead

Nginx does not read .htaccess files. Equivalent rules live in the server block of /etc/nginx/sites-available/<site>.conf and use Nginx's rewrite, return, gzip, brotli, expires, and deny directives. If your stack is Nginx-only, this generator's output is informational — translate the patterns into Nginx syntax.

Source references

API Usage Example:

POST /api/tools/security/htaccess-generator
Content-Type: application/json

{
    "forceHttps": true,
    "wwwMode": "force-non-www",
    "gzip": true
}
Ready