.htaccess Generator
Build an .htaccess file for redirects, HTTPS, caching and security.
Build an .htaccess file for Apache or LiteSpeed. Choose the
behaviours you need — force HTTPS, canonicalise www, enable compression and
caching, block hotlinking, add security headers — and the rules are emitted in the
order Apache actually evaluates them.
That ordering is the part most generated files get wrong, and the reason a rule that looks correct silently never fires.
How it works
.htaccess is a per-directory configuration file read on
every single request, for the requested directory and every parent above
it. That cost is why the Apache documentation recommends putting rules in the main
server config where you can — but on shared hosting you usually cannot, which is
what makes .htaccess ubiquitous.
Order is not cosmetic. Rewrite rules are evaluated top to
bottom, and a rule ending in [L] stops processing for that pass. If a
front-controller rule (RewriteRule ^ index.php [L]) sits above your
HTTPS redirect, the redirect never runs — every request is captured first. This
generator emits canonical redirects before anything else for exactly that
reason.
Rules worth understanding:
- Force HTTPS. Behind a proxy or CDN, checking
%{HTTPS}can fail, because the connection to your origin may genuinely be HTTP. The generator also checks%{HTTP:X-Forwarded-Proto}, without which you get an infinite redirect loop — the single most common .htaccess disaster. - Combine redirects. Sending
http://example.comtohttps://example.comand then tohttps://www.example.comcosts two round trips. One rule handling protocol and host together costs one. - Caching. Hashed asset filenames can be cached for a year
with
immutable. HTML must not be, or visitors will see stale pages after you deploy. - Hotlink protection blocks other sites embedding your images. Always allow an empty referrer, or you break direct visits and some privacy browsers.
One caution: a syntax error in .htaccess returns a 500 on
every page, not just the affected path. Keep a copy of the previous file
before replacing it.
Frequently asked questions
Why did my whole site break with a 500 error?
A syntax error, or a directive your host does not permit. Unlike most config problems this takes down every page at once. Rename the file to .htaccess.bak to confirm, then reintroduce blocks one at a time.
Why is my HTTPS redirect looping infinitely?
Almost always a proxy or CDN. Cloudflare may connect to your origin over HTTP, so %{HTTPS} is off even though the visitor is on HTTPS — your rule redirects, the CDN requests again over HTTP, forever. Check %{HTTP:X-Forwarded-Proto} as well, which the rules here do.
Should I use www or non-www?
It genuinely does not matter for SEO — pick one and redirect the other consistently. www has a mild technical advantage: it can be a CNAME, letting you point it at a CDN, while a root domain usually cannot.
Does .htaccess slow down my site?
Slightly. Apache reads it on every request for the directory and every parent, and cannot cache the result. On shared hosting the effect is small and unavoidable; on your own server, move the rules into the vhost config and disable .htaccess entirely.
Where does the file go?
Your web root — usually public_html or the directory your domain points at. Rules apply to that directory and everything below it, and a file in a subdirectory overrides its parent for that path.
Does this work on nginx?
No. nginx does not read .htaccess at all, by design. These rules apply to Apache and LiteSpeed only — use the nginx config generator instead, which produces the equivalent server block.
Related tools
Nginx Config Generator
Build an nginx server block for PHP, WordPress, Laravel, SPAs or a proxy.
Server Config301 Redirect Generator
Generate exact 301 redirect code for Apache, Nginx, and PHP.
Server Config.htaccess to Nginx Converter
Convert common Apache .htaccess rewrite rules into Nginx configuration syntax.
Server ConfigSecurity Headers Checker
Grade any site's HTTP security headers and see exactly what to add.
SecurityRedirect Checker
Trace every hop a URL redirects through, with status codes and timings.
Network & IP.htpasswd Generator
Create Apache basic-auth credentials in bcrypt, APR1 or SHA-1.
SecurityNeed hosting that just works?
Free SSL, daily backups and 24×7 support on every Loudhost plan.