Get online today — Domain + Hosting at discounted prices View Combo Offers ›

.htaccess Generator

Build an .htaccess file for redirects, HTTPS, caching and security.

One per line. Leave empty to skip.

Build an .htaccess file for Apache or LiteSpeed. Choose the behaviours you need — force HTTPS, canonicalise www, enable compression and caching, block hotlinking, add security headers — and the rules are emitted in the order Apache actually evaluates them.

That ordering is the part most generated files get wrong, and the reason a rule that looks correct silently never fires.

How it works

.htaccess is a per-directory configuration file read on every single request, for the requested directory and every parent above it. That cost is why the Apache documentation recommends putting rules in the main server config where you can — but on shared hosting you usually cannot, which is what makes .htaccess ubiquitous.

Order is not cosmetic. Rewrite rules are evaluated top to bottom, and a rule ending in [L] stops processing for that pass. If a front-controller rule (RewriteRule ^ index.php [L]) sits above your HTTPS redirect, the redirect never runs — every request is captured first. This generator emits canonical redirects before anything else for exactly that reason.

Rules worth understanding:

  • Force HTTPS. Behind a proxy or CDN, checking %{HTTPS} can fail, because the connection to your origin may genuinely be HTTP. The generator also checks %{HTTP:X-Forwarded-Proto}, without which you get an infinite redirect loop — the single most common .htaccess disaster.
  • Combine redirects. Sending http://example.com to https://example.com and then to https://www.example.com costs two round trips. One rule handling protocol and host together costs one.
  • Caching. Hashed asset filenames can be cached for a year with immutable. HTML must not be, or visitors will see stale pages after you deploy.
  • Hotlink protection blocks other sites embedding your images. Always allow an empty referrer, or you break direct visits and some privacy browsers.

One caution: a syntax error in .htaccess returns a 500 on every page, not just the affected path. Keep a copy of the previous file before replacing it.

Frequently asked questions

Why did my whole site break with a 500 error?

A syntax error, or a directive your host does not permit. Unlike most config problems this takes down every page at once. Rename the file to .htaccess.bak to confirm, then reintroduce blocks one at a time.

Why is my HTTPS redirect looping infinitely?

Almost always a proxy or CDN. Cloudflare may connect to your origin over HTTP, so %{HTTPS} is off even though the visitor is on HTTPS — your rule redirects, the CDN requests again over HTTP, forever. Check %{HTTP:X-Forwarded-Proto} as well, which the rules here do.

Should I use www or non-www?

It genuinely does not matter for SEO — pick one and redirect the other consistently. www has a mild technical advantage: it can be a CNAME, letting you point it at a CDN, while a root domain usually cannot.

Does .htaccess slow down my site?

Slightly. Apache reads it on every request for the directory and every parent, and cannot cache the result. On shared hosting the effect is small and unavoidable; on your own server, move the rules into the vhost config and disable .htaccess entirely.

Where does the file go?

Your web root — usually public_html or the directory your domain points at. Rules apply to that directory and everything below it, and a file in a subdirectory overrides its parent for that path.

Does this work on nginx?

No. nginx does not read .htaccess at all, by design. These rules apply to Apache and LiteSpeed only — use the nginx config generator instead, which produces the equivalent server block.

Related tools

Need hosting that just works?

Free SSL, daily backups and 24×7 support on every Loudhost plan.

View Hosting Plans