.htaccess Generator for Apache

Generate Apache .htaccess rules: force HTTPS, add or remove www, 301 redirects, error pages, gzip, browser caching, security headers and dotfile blocks.

Redirect HTTP to HTTPS (301)Send HSTS header (Strict-Transport-Security)Disable directory listingsBlock access to hidden files (.env, .git…)Compress text responses (mod_deflate)Browser caching rules (mod_expires)Basic security headers (nosniff, SAMEORIGIN, Referrer-Policy)

www handling

301 redirects (one per line: /old-path /new-path [status])

Status can be 301, 302, 303, 307, 308 or 410 (gone). The new path may be a full URL.

Custom page for error 404

Custom page for error 500

.htaccess

<IfModule mod_rewrite.c>
  RewriteEngine On
  # Redirect HTTP to HTTPS
  RewriteCond %{HTTPS} off
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

# Redirects (mod_alias)
Redirect 301 /old-page /new-page
Redirect 301 /blog/2019 /blog

# Custom error pages
ErrorDocument 404 /404.html

# Disable directory listings
Options -Indexes

# Block access to hidden files such as .env and .git
<FilesMatch "^\.">
  Require all denied
</FilesMatch>
RedirectMatch 404 /\.git

# Security headers
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Compress text responses
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/css text/xml text/javascript
  AddOutputFilterByType DEFLATE application/javascript application/json application/xml application/rss+xml
  AddOutputFilterByType DEFLATE image/svg+xml font/ttf font/otf
</IfModule>

# Browser caching
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresDefault "access plus 1 month"
  ExpiresByType text/html "access plus 0 seconds"
  ExpiresByType text/css "access plus 1 year"
  ExpiresByType application/javascript "access plus 1 year"
  ExpiresByType text/javascript "access plus 1 year"
  ExpiresByType image/jpeg "access plus 1 year"
  ExpiresByType image/png "access plus 1 year"
  ExpiresByType image/webp "access plus 1 year"
  ExpiresByType image/avif "access plus 1 year"
  ExpiresByType image/svg+xml "access plus 1 year"
  ExpiresByType image/x-icon "access plus 1 year"
  ExpiresByType font/woff2 "access plus 1 year"
</IfModule>

For Apache 2.4 with mod_rewrite, mod_alias, mod_headers, mod_deflate and mod_expires (blocks are wrapped in IfModule where possible). Test on a staging server first – a syntax error in .htaccess causes HTTP 500 for the whole folder. Nginx does not read .htaccess.

What is .htaccess Generator?

This tool generates a ready-to-use .htaccess file for Apache 2.4. Tick the features you need – HTTPS redirect, www or non-www canonical host, HSTS, directory listing off, hidden file protection, gzip compression, browser caching, basic security headers – and add your own 301/302/410 redirects and custom error pages.

How to use .htaccess Generator

Tick the options you need and choose how www should be handled.
Enter redirects as /old-path /new-path, optionally followed by a status (301, 302, 303, 307, 308 or 410).
Enter paths for custom 404 and 500 pages.
Copy or download the result as .htaccess and test it on a staging server first.

Example

Input

Force HTTPS, remove www, redirect /old-page → /new-page

Output

RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]
Redirect 301 /old-page /new-page

When to use .htaccess Generator

Use it on shared hosting or Apache servers where you cannot edit the main server config. On Nginx, LiteSpeed's own settings, Cloudflare or a CDN, use their configuration instead – Nginx ignores .htaccess entirely. A syntax error causes HTTP 500 for the whole directory, so always test.

How .htaccess Generator works

HTTPS and www rules use mod_rewrite (RewriteCond %{HTTPS} off and host conditions) inside <IfModule mod_rewrite.c>; the www redirect uses https directly when HTTPS is forced, avoiding a two-hop chain. Path redirects use mod_alias Redirect lines (Redirect gone for 410). Compression uses mod_deflate, caching mod_expires with long lifetimes for static assets and none for HTML, and headers mod_headers with Header always set. Dotfiles are denied with <FilesMatch "^\."> and RedirectMatch 404 /\.git.