.htaccess Generator

Force HTTPS, redirect www, enable gzip & caching — no hand-coding.

Build a standard Apache .htaccess file from simple toggles — force HTTPS, redirect www to non-www (or the reverse), add custom 301/302 redirects, enable 7 editable security headers (CSP, HSTS, X-Frame-Options and more) plus optional CORS, turn on gzip compression and per-file-type browser caching, block directory listing and hidden or sensitive files, protect against image hotlinking, set custom error pages, add a single-page-app fallback, and tune PHP upload limits. No need to hand-write mod_rewrite rules. Runs fully in your browser — nothing you configure is uploaded.

How to use .htaccess Generator

1. Turn on quick toggles

   Force HTTPS, Gzip Compression, Disable Directory Listing, Hotlink Protection, Custom Error Pages and CORS Headers — flip whichever ones your site needs.

2. Set your domain & redirects

   Enter your domain, pick a WWW redirect (None, Force www or Remove www), and add any custom old-URL → new-URL redirects.

3. Choose your security headers

   Each header — X-Frame-Options, Content-Security-Policy and more — has a sensible default value you can edit or turn off individually.

4. Set browser caching per file type

   Give Images, CSS, JavaScript, Fonts and Documents their own cache lifetime in days, based on how often each one actually changes.

5. Copy or download

   Copy the generated rules or download the file as .htaccess and upload it to your Apache site's root folder.

Understanding .htaccess

What is a .htaccess file?

A .htaccess file is Apache's per-directory configuration file — it lets you override server behavior for just one folder, without touching the main server config or restarting Apache. On shared hosting, where you usually can't edit the main config at all, it's often the only way to control redirects, security headers, caching and URL rewriting.

Where does .htaccess actually go?

It always lives in the folder Apache treats as the Document Root — and that folder is different for every stack:

• Plain Apache / static HTML next to index.html, in your site's root folder
• WordPress the WordPress root, next to wp-config.php — never inside wp-content or wp-admin
• Laravel inside /public, Laravel's own document root — not the project root next to artisan
• React / Vite your BUILD output folder (dist or build) after npm run build — never your source src/ folder
• cPanel / shared hosting public_html for your main domain; each subdomain or addon domain gets its own folder and its own .htaccess

Key Apache directives you'll see in the output

• RewriteEngine / RewriteRule rewrite and redirect URLs (mod_rewrite)
• Header set add or change an HTTP response header (mod_headers)
• ExpiresByType set how long a browser caches a given file type (mod_expires)
• AddOutputFilterByType DEFLATE enable gzip compression (mod_deflate)
• ErrorDocument point an HTTP error code to a custom page
• Options -Indexes turn off automatic directory listings

A note on performance

Apache re-checks .htaccess on every single request, walking every directory along the path to the requested file — on a high-traffic site that adds up. If you ever get access to the main server config (httpd.conf or a virtual host block), moving these same rules there removes that per-request overhead entirely. Either way, only enable the Apache modules you actually use.

Security habits worth following

• Turn on HSTS (Strict-Transport-Security) only after confirming HTTPS works everywhere — browsers cache it hard, so it's awkward to undo.
• Start a new Content-Security-Policy loosely and tighten it gradually, so you catch broken resources before locking things down.
• Keep directory listing disabled so your folder structure is never exposed to visitors.
• Block direct access to .env, .git and backup files — they're a common target for automated scanners.
• Use a 301 redirect only for a permanent move; use 302 for anything temporary.

Common mistakes that break a .htaccess file

• A redirect loop is the #1 issue — add and test one rule at a time.
• Forgetting RewriteEngine On silently disables every rewrite rule below it.
• Order matters: rules run top to bottom, and the [L] flag stops processing right there.
• A directive that needs a module your host hasn't enabled can cause a 500 error — wrapping it in <IfModule> makes it skip safely instead.

Frequently asked questions

What is an .htaccess file?

An .htaccess file is a per-directory configuration file read by the Apache web server. It lets you control redirects, URL rewriting, security headers, caching, compression, access restrictions and error pages without editing the main server configuration — most shared hosting plans rely on it for exactly this reason.

How do I generate a .htaccess file?

Enter your domain, toggle the redirects and rules you need — force HTTPS, WWW handling, security headers, gzip, per-type caching, custom error pages and more — and this tool assembles a ready-to-use .htaccess instantly. Copy it or download the file and upload it to your site's root folder.

Where do I upload the .htaccess file?

Upload it to the root directory of your website (the same folder as index.php or index.html) via FTP or your host's file manager. It's a hidden file — make sure your FTP client is set to show hidden/dotfiles so you don't accidentally create a folder instead.

Where does .htaccess go in WordPress, Laravel or a React app?

It depends on the stack's actual Document Root, not just the project folder. WordPress: the WordPress root, next to wp-config.php. Laravel: inside /public, not the project root next to artisan. React/Vite: your build output folder (dist or build), not src/. Use the "Where does .htaccess go?" section on this page to see the exact folder structure for your stack.

Why does my .htaccess file not work?

The most common cause is AllowOverride None in the Apache virtual host config, which ignores .htaccess entirely — ask your host to set AllowOverride All. Also confirm mod_rewrite, mod_headers, mod_deflate and mod_expires are enabled, since this file only works on Apache (or Apache-compatible) servers, not Nginx or IIS.

How do I force HTTPS and redirect www to non-www?

Turn on "Force HTTPS" and choose "Remove www" (or "Force www") in the WWW Redirect row. This generator writes the correct RewriteCond/RewriteRule pairs in the right order so both redirects work together without a redirect loop.

Which security headers should I enable?

All seven — X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, Strict-Transport-Security, Content-Security-Policy and Permissions-Policy — are turned on by default with safe, commonly-used values. You can edit any value or switch a header off individually if it conflicts with something your site needs.

What's the difference between the security-header defaults and gzip/caching?

Security headers tell the browser how to treat your page (blocking clickjacking, MIME sniffing and so on) and cost nothing in performance. Gzip and browser caching are separate performance features — gzip shrinks the response as it's sent, while caching tells the browser to reuse a file instead of re-downloading it for the number of days you set per file type.

Can this .htaccess file break my site?

A misconfigured .htaccess can cause a 500 Internal Server Error, usually from a syntax issue or a module that isn't enabled on your server. Always keep a backup of your working .htaccess (or none at all) before uploading a new one, and test the site immediately after.

Is this .htaccess generator free?

Yes, it's completely free with no sign-up, no API key and no usage limit. Every rule is assembled locally in your browser from plain JavaScript — your domain and settings are never uploaded or stored.

Related tools — Developer · Config file generators

• .env File Generator — Build a .env file from key/value rows, or a framework preset.
• .gitignore Generator — Combine language, framework, editor & OS templates into one file.