elefcode

.htaccess Generator

Force HTTPS, redirect pages, fix www, cache and compress files, block hotlinking and password-protect Apache sites.

Start from:
URLs
www
Trailing slash
Unknown paths
Redirects
Speed
Security
.htaccess
# Do not list folder contents
Options -Indexes

<IfModule mod_rewrite.c>
RewriteEngine On

# HTTPS
RewriteCond %{HTTPS} off
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Drop www
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]
</IfModule>

# Redirects
Redirect 301 /old-page /new-page

# Custom error pages
ErrorDocument 404 /404.html

# Hide dotfiles and folders like .env and .git (but not .well-known)
RedirectMatch 404 /\.(?!well-known/)

# Security headers
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Compression
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/css text/xml text/javascript
    AddOutputFilterByType DEFLATE application/javascript application/json application/xml application/rss+xml
    AddOutputFilterByType DEFLATE image/svg+xml font/ttf font/otf
</IfModule>

# Browser caching
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresDefault "access plus 1 month"
    ExpiresByType text/html "access plus 0 seconds"
    ExpiresByType application/json "access plus 0 seconds"
    ExpiresByType text/css "access plus 1 year"
    ExpiresByType application/javascript "access plus 1 year"
    ExpiresByType text/javascript "access plus 1 year"
    ExpiresByType image/svg+xml "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType image/gif "access plus 1 year"
    ExpiresByType image/webp "access plus 1 year"
    ExpiresByType image/avif "access plus 1 year"
    ExpiresByType image/x-icon "access plus 1 year"
    ExpiresByType font/woff2 "access plus 1 year"
</IfModule>

Put it in your site’s root folder. Apache must allow overrides (AllowOverride All) for it to take effect. Uses Apache 2.4 syntax.

Advertisement

Guide

About the .htaccess Generator

.htaccess is a per-folder configuration file for the Apache web server. Shared hosts that do not let you edit the main server config almost always allow it, so it is where redirects, HTTPS enforcement, caching rules and access control usually live.

Tick what you need and the generator writes the rules in a safe order, each wrapped in an IfModule check so a missing module does not take the site down.

Order matters

Apache runs rewrite rules top to bottom. HTTPS and www redirects come first so a visitor is sent to the canonical address in one hop, then trailing-slash and hotlink rules, and the catch-all routing to index.html or index.php comes last so it does not swallow anything before it.

301 or 302?

A 301 says the page has moved for good: search engines move its ranking to the new URL and browsers cache the redirect, sometimes for a long time. Use 302 while you are testing or when the move is temporary, and switch to 301 once you are sure.

How to use it

  1. 1Pick a preset or start from the defaults.
  2. 2Choose HTTPS, www and routing behaviour.
  3. 3Add redirects and the speed and security options you want.
  4. 4Download .htaccess and upload it to your site’s root folder.

Frequently asked questions

Why is my .htaccess file ignored?

Apache only reads it when the virtual host allows overrides with AllowOverride All (or at least FileInfo and AuthConfig). Many default configs set AllowOverride None. nginx does not read .htaccess at all.

Why do I get a redirect loop after forcing HTTPS?

Behind Cloudflare or a load balancer, Apache sees plain HTTP even when the visitor uses HTTPS. The generated rule also checks X-Forwarded-Proto to avoid that loop.

How do I make React Router work on Apache?

Choose “→ index.html (SPA)” under Unknown paths. Requests for files that do not exist are served index.html, and the client-side router takes over.

How do I password-protect a folder?

Tick Password-protect, enter the absolute path to a .htpasswd file, and place the .htaccess in the folder to protect. Create the .htpasswd with the htpasswd command.

Does hotlink protection hurt SEO?

No. Requests with no referer are allowed, so direct visits, most search crawlers and image search keep working. Only pages on other domains that embed your files are blocked.

Is .htaccess slower than the main config?

Slightly, because Apache checks for the file in every folder on each request. On your own server you can move the same rules into the virtual host and turn overrides off.

Related tools

Nginx Config GeneratorSecurity Headers GeneratorBasic Auth HeaderRobots.txt Generator