Where should I place the .htaccess file?

Place it in your website's root directory (usually public_html, www, or htdocs). The file affects that directory and all subdirectories. You can have multiple .htaccess files in different directories for specific rules.

Why should I force HTTPS with .htaccess?

HTTPS encrypts data between browser and server, protecting user privacy and preventing man-in-the-middle attacks. It's required for many modern features (geolocation, service workers), improves SEO (Google ranking factor), and browsers warn users about non-HTTPS sites.

Should I use WWW or non-WWW for my domain?

Either works, but pick one and redirect the other to prevent duplicate content issues. Non-WWW is shorter and modern. WWW allows cookie isolation for subdomains. The tool generates proper 301 redirects to your canonical version.

What is browser caching and how do I configure it?

Browser caching tells browsers to store static files (images, CSS, JS) locally for a specified time. This reduces server load and speeds up page loads for returning visitors. Set longer expiry for static assets (1 year) and shorter for dynamic content.

What is Gzip compression in .htaccess?

Gzip compresses text-based files (HTML, CSS, JS, JSON, XML) before sending them to browsers. This can reduce file sizes by 70-90%, significantly improving load times. All modern browsers support Gzip decompression automatically.

What is hotlink protection and why use it?

Hotlink protection prevents other websites from embedding your images directly, which would use your bandwidth and server resources. Only requests from your domain are allowed. Hotlinkers see a placeholder image or error instead.

Why should I block bad bots with .htaccess?

Some bots aggressively crawl websites, consuming server resources and bandwidth. Blocking known bad bots (scrapers, spam bots, vulnerability scanners) improves server performance and security. The tool includes rules for common bad bots.

What are security headers and which ones should I use?

Security headers instruct browsers on how to handle your content. Essential headers: X-Content-Type-Options (prevent MIME sniffing), X-Frame-Options (prevent clickjacking), X-XSS-Protection (XSS filtering), Content-Security-Policy (CSP), and Strict-Transport-Security (HSTS).

What is HSTS and should I enable it?

HSTS (HTTP Strict Transport Security) tells browsers to always use HTTPS for your domain. Once set, browsers refuse HTTP connections. Enable only after confirming HTTPS works perfectly. Start with a short max-age, then increase to 1-2 years.

What is Content Security Policy (CSP)?

CSP is a security header that controls which resources (scripts, styles, images) can load on your page. It prevents XSS attacks by blocking unauthorized scripts. Start with report-only mode to identify issues before enforcing.

How do I set up custom error pages?

Use ErrorDocument directives: ErrorDocument 404 /404.html, ErrorDocument 500 /500.html. Create custom HTML pages for better user experience when errors occur. The tool generates rules for common error codes (400, 401, 403, 404, 500, 503).

Will .htaccess work on my server?

.htaccess works on Apache servers with AllowOverride enabled. It does NOT work on Nginx, IIS, or other servers. Check with your hosting provider. For Nginx, you'll need to configure nginx.conf instead. Many hosts provide control panels for similar settings.

Is my .htaccess configuration secure when using this tool?

Yes! All .htaccess generation happens 100% in your browser using JavaScript. Your configuration is NEVER sent to any server, stored, or logged. The tool works completely offline for maximum privacy and security.

Where should I place the .htaccess file?

Place it in your website's root directory (usually public_html, www, or htdocs). The file affects that directory and all subdirectories. You can have multiple .htaccess files in different directories for specific rules.

Why should I force HTTPS with .htaccess?

HTTPS encrypts data between browser and server, protecting user privacy and preventing man-in-the-middle attacks. It's required for many modern features (geolocation, service workers), improves SEO (Google ranking factor), and browsers warn users about non-HTTPS sites.

Should I use WWW or non-WWW for my domain?

Either works, but pick one and redirect the other to prevent duplicate content issues. Non-WWW is shorter and modern. WWW allows cookie isolation for subdomains. The tool generates proper 301 redirects to your canonical version.

What is browser caching and how do I configure it?

Browser caching tells browsers to store static files (images, CSS, JS) locally for a specified time. This reduces server load and speeds up page loads for returning visitors. Set longer expiry for static assets (1 year) and shorter for dynamic content.

What is Gzip compression in .htaccess?

Gzip compresses text-based files (HTML, CSS, JS, JSON, XML) before sending them to browsers. This can reduce file sizes by 70-90%, significantly improving load times. All modern browsers support Gzip decompression automatically.

What is hotlink protection and why use it?

Hotlink protection prevents other websites from embedding your images directly, which would use your bandwidth and server resources. Only requests from your domain are allowed. Hotlinkers see a placeholder image or error instead.

Why should I block bad bots with .htaccess?

Some bots aggressively crawl websites, consuming server resources and bandwidth. Blocking known bad bots (scrapers, spam bots, vulnerability scanners) improves server performance and security. The tool includes rules for common bad bots.

What are security headers and which ones should I use?

Security headers instruct browsers on how to handle your content. Essential headers: X-Content-Type-Options (prevent MIME sniffing), X-Frame-Options (prevent clickjacking), X-XSS-Protection (XSS filtering), Content-Security-Policy (CSP), and Strict-Transport-Security (HSTS).

What is HSTS and should I enable it?

HSTS (HTTP Strict Transport Security) tells browsers to always use HTTPS for your domain. Once set, browsers refuse HTTP connections. Enable only after confirming HTTPS works perfectly. Start with a short max-age, then increase to 1-2 years.

What is Content Security Policy (CSP)?

CSP is a security header that controls which resources (scripts, styles, images) can load on your page. It prevents XSS attacks by blocking unauthorized scripts. Start with report-only mode to identify issues before enforcing.

How do I set up custom error pages?

Use ErrorDocument directives: ErrorDocument 404 /404.html, ErrorDocument 500 /500.html. Create custom HTML pages for better user experience when errors occur. The tool generates rules for common error codes (400, 401, 403, 404, 500, 503).

Will .htaccess work on my server?

.htaccess works on Apache servers with AllowOverride enabled. It does NOT work on Nginx, IIS, or other servers. Check with your hosting provider. For Nginx, you'll need to configure nginx.conf instead. Many hosts provide control panels for similar settings.

Is my .htaccess configuration secure when using this tool?

Yes! All .htaccess generation happens 100% in your browser using JavaScript. Your configuration is NEVER sent to any server, stored, or logged. The tool works completely offline for maximum privacy and security.

.htaccess Generator

medium

Advanced .htaccess generator with 5 presets (Basic, WordPress, Security, Performance, SPA), 30+ configuration options for redirects, caching, compression, security headers, HSTS, CSP, bot blocking, IP blocking, password protection, CORS, and PHP settings.

Web Developmenthtaccessapacheredirectcache

100% Private - Runs Locally

How to Use

1Select a preset (Basic, WordPress, Security, Performance, SPA) or start from scratch
2Configure redirects, HTTPS, WWW handling
3Set up browser caching and compression
4Enable security features (headers, HSTS, CSP, bot blocking)
5Add custom error pages and PHP settings
6Download or copy the generated .htaccess file

Examples

Force HTTPS

Input

Enable HTTPS redirect

Output

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Enable Caching

Input

Browser caching for static assets

Output

<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/css "access plus 168 hours"
  ExpiresByType application/javascript "access plus 168 hours"
  ExpiresByType image/jpeg "access plus 720 hours"
</IfModule>

Security Headers

Input

Add security headers

Output

<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set X-XSS-Protection "1; mode=block"
</IfModule>

Frequently Asked Questions

Related Tools

View all

robots.txt Generator

Advanced robots.txt generator with 7 presets (Allow All, Block All, Standard, WordPress, E-commerce, Block AI, Block SEO), 50+ user agents organized by category, common path templates, import/parse existing files, and validation.

Sitemap.xml Generator

Advanced sitemap generator with 5 types (Standard, Index, Image, Video, News), 5 presets, bulk URL import, validation, and detailed statistics for SEO optimization.

Meta Tag Generator

Generate HTML meta tags for SEO, social sharing, and search engine optimization. Includes Open Graph, Twitter Cards, and all essential meta tags.

<IfModule mod_expires.c> ExpiresActive On ExpiresByType text/css "access plus 168 hours" ExpiresByType application/javascript "access plus 168 hours" ExpiresByType image/jpeg "access plus 720 hours" </IfModule>