Pick the features you want and get a clean, commented .htaccess file for Apache: HTTPS and www redirects, gzip or Brotli compression, browser caching, custom error pages, IP blocking, hotlink protection and basic security headers.
Last updated:
Quick start:
Site
Redirects
Performance
Custom error pages
Block IP addresses
Hotlink protection
Security & misc
Your .htaccess file
Upload the file to your site's root folder (usually public_html) and name it exactly .htaccess. Keep a backup of any existing file first.
Advertisement
Advertisement
How to use the Htaccess Generator
Enter your domain and choose Apache 2.4 (most hosts) or 2.2.
Tick the features you need, or start from a preset such as Basic site.
Read the warnings under the file; they flag risky or incomplete choices.
Copy or download the file, upload it to your site root as .htaccess and test your pages.
What each section does
Option
Apache module
Directive used
Effect
Force HTTPS / www
mod_rewrite
RewriteCond, RewriteRule [R=301]
Permanent redirect to one canonical address
HSTS
mod_headers
Header always set Strict-Transport-Security
Browsers use HTTPS automatically on later visits
Gzip
mod_deflate
AddOutputFilterByType DEFLATE
Text files are typically 60-80% smaller on the wire
Brotli
mod_brotli
AddOutputFilterByType BROTLI_COMPRESS
Usually a little smaller than gzip for text
Browser caching
mod_expires
ExpiresByType
Repeat visitors reuse files instead of downloading them
Error pages
core
ErrorDocument
Friendly page instead of the server default
Block IPs
mod_authz_core (2.4)
Require not ip
Listed addresses get 403 Forbidden
Hotlink protection
mod_rewrite
RewriteCond %{HTTP_REFERER}
Other sites cannot embed your images or video
Directory listing
core
Options -Indexes
Folders without an index file return 403
Testing your .htaccess safely
Download a backup of the current file before replacing it.
Test redirects with a short HSTS time (or HSTS off) first: browsers remember HSTS and permanent redirects.
Open http://, http://www. and https://www. versions of your homepage and check you land on one address in a single hop.
Check compression and caching in your browser's developer tools: the Network tab shows content-encoding: gzip or br and the cache-control header.
If the site shows a 500 error, restore the backup and add sections back one at a time.
Apache 2.4 vs 2.2 access rules
Apache 2.4 replaced Order, Allow and Deny with Require. Mixing the two styles in one file causes confusing results, so pick the version your host runs (almost all current hosts use 2.4). Blocking with <RequireAll> Require all granted / Require not ip …</RequireAll> lets everyone in except the listed addresses.
Frequently asked questions
What is an .htaccess file?
It is a configuration file that the Apache web server reads from a folder of your site. Rules in it apply to that folder and everything below it, so you can add redirects, compression, caching and access rules without editing the main server configuration.
Where do I put the .htaccess file?
Upload it to the document root of your site, usually public_html or www, using FTP or your host's file manager. The name must be exactly .htaccess with the leading dot and no extension. Many file managers hide dot files, so turn on 'show hidden files'.
Why do I get a 500 Internal Server Error after uploading?
Usually a module is missing or a directive is not allowed on your host. This generator wraps rules in IfModule blocks to avoid that, but if it still happens, remove sections one by one to find the cause, and check that your host allows .htaccess overrides (AllowOverride).
How do I force HTTPS with .htaccess?
Use mod_rewrite: RewriteCond %{HTTPS} off followed by RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [L,R=301]. If your site sits behind Cloudflare or a load balancer, check the X-Forwarded-Proto header instead, otherwise the redirect can loop.
Does .htaccess work on Nginx?
No. Nginx does not read .htaccess files; the same features have to be written in the server block of the Nginx configuration. LiteSpeed and OpenLiteSpeed servers do read most Apache .htaccess rules.
Will long browser caching break my updates?
Visitors keep cached files until they expire, so after changing a CSS or JavaScript file they may see the old version. Change the file name or add a version query string (style.css?v=2) whenever you update a long-cached file; keep HTML at a short or zero cache time.
Does .htaccess slow down my site?
Slightly: Apache checks for .htaccess files in each folder on every request. On shared hosting this is normal and the effect is tiny. If you control the server, the same rules can go into the main configuration with AllowOverride None for the best speed.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.