.htaccess Generator
Apache Redirects, HTTPS, Gzip & Caching

Build an Apache .htaccess file without memorizing the syntax

The Apache .htaccess file is one of the most powerful tools on a web server — and one of the easiest to get wrong, since a single typo can take your whole site down with a 500 error. This htaccess generator removes the guesswork: flip on the rules you want (force HTTPS, redirect www, enable gzip, set caching, add security headers) and a clean, fully-commented .htaccess is assembled live in your browser. Copy it, back up your existing file, and upload.

What is an .htaccess file?

“.htaccess” stands for hypertext access. It's a per-directory configuration file read by the Apache web server (and the Apache-compatible LiteSpeed). Drop one into a folder and it changes how the server treats that folder and everything beneath it — without touching the main server config or needing a restart. Hosts love it because it lets users on shared hosting customise behaviour safely. Typical jobs include redirecting URLs, forcing HTTPS, compressing responses, controlling caching, restricting access, and defining custom error pages.

Important: .htaccess is an Apache feature. Nginx ignores it entirely — on Nginx the same logic lives in your server block. If your host runs LiteSpeed, you're fine: it reads .htaccess like Apache does.

Force HTTPS the right way

Serving your site over HTTPS is non-negotiable for SEO and security. The generated rule uses mod_rewrite to issue a 301 (permanent) redirect from any http:// request to its https:// equivalent:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

A 301 (rather than a 302) tells browsers and search engines the move is permanent, so link equity transfers and the secure URL gets indexed. Pair it with the HSTS header (also available here) to instruct browsers to skip the insecure request entirely on future visits.

www vs non-www: pick one and redirect

Search engines treat https://example.com and https://www.example.com as two different sites, which splits your ranking signals and can cause duplicate-content issues. Choose a canonical version and 301-redirect the other to it. This generator writes either direction for you — force-www (adds the prefix) or force-non-www (strips it) — using your domain name.

Speed: gzip compression and browser caching

Two rules give an immediate performance and Core Web Vitals boost:

• Gzip compression (mod_deflate) shrinks text assets — HTML, CSS, JavaScript, JSON, SVG, fonts — on the fly, usually by 60–80%. Smaller payloads mean faster downloads.
• Browser caching (mod_expires) sets far-future Expires and Cache-Control headers on static files, so returning visitors load images, scripts and styles from their local cache instead of re-downloading them.

The generated caching block uses sensible defaults: a year for images and fonts, a month for CSS/JS, and no-cache for HTML so content updates are seen immediately.

Hardening: security headers and access control

A few response headers meaningfully reduce common attacks. The “Security headers” option adds:

You can also disable directory listing (so visitors can't browse your folders), protect dotfiles like .htaccess and .env from being served, and block image hotlinking so other sites can't embed your images and steal your bandwidth.

Routing and errors

Running a single-page app (React, Vue, Angular)? The SPA fallback rule rewrites unknown paths to index.html so client-side routing works on refresh. You can also define custom 404 and 500 error pages for a branded experience, and password-protect a directory with HTTP Basic Auth (the generator emits the matching AuthType block; create the .htpasswd file with your host's tool).

How to install your .htaccess

1. Back up any existing .htaccess first — a mistake can 500 your site.
2. Copy or download the generated file.
3. Upload it (named exactly .htaccess) to your site's root, typically public_html or htdocs.
4. Apache applies it instantly — reload your site and verify. If you see a 500 error, restore your backup and re-check the rules you enabled.

Setting up the rest of your project? Generate a .gitignore for your repo and an optimized Dockerfile if you're containerising the app.