.htaccess Generator

How This .htaccess Generator Works

This tool assembles a real Apache configuration file from the options you choose, entirely in your browser — no server round-trip. Every generated block uses well-established, documented Apache directives, wrapped in <IfModule> checks where appropriate so a missing module fails gracefully instead of breaking your entire site.

What is .htaccess?

A .htaccess file ("hypertext access") is a plain-text configuration file that Apache reads on every request to the directory it lives in (and its subdirectories), letting you control redirects, URL rewriting, access restrictions, and headers without touching the main server configuration — ideal for shared hosting where you don't have access to httpd.conf.

Apache Web Server Overview

Apache HTTP Server is one of the most widely deployed web servers, powering a large share of the web — especially on shared and managed hosting, where .htaccess is often the only configuration surface available to site owners.

How .htaccess Works

Apache checks for a .htaccess file in every directory along the path of an incoming request (if AllowOverride is enabled for that directory) and merges its directives with the server's own configuration — meaning rules placed at your document root apply site-wide, while rules in a subdirectory only affect that subdirectory.

RewriteEngine, RewriteRule & RewriteCond Explained

RewriteEngine On turns on Apache's URL-rewriting engine (mod_rewrite) for that scope. A RewriteRule matches the requested URL against a regular expression and rewrites or redirects it to a target. A RewriteCond placed immediately before a RewriteRule adds an extra condition — like checking the HTTP_HOST or whether the connection is HTTPS — that must also be true for the rule to fire; multiple consecutive RewriteCond lines are combined with AND by default, or OR when explicitly flagged.

# Only redirect when the connection is plain HTTP...
RewriteCond %{HTTPS} off
# ...to the same URL, but on HTTPS
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

301 vs. 302 vs. 307 vs. 308 Redirects

301 (Moved Permanently) tells browsers and search engines the move is permanent and passes SEO value to the new URL — use it for canonical redirects. 302 (Found) signals a temporary move and is cached less aggressively. 307 and 308 behave like 302 and 301 respectively, but explicitly guarantee the request method (GET, POST, etc.) is preserved on the redirect, which matters for form submissions and APIs.

HTTPS & WWW Redirects

Search engines treat http:// and https://, and www. and non-www., as different URLs unless you redirect consistently to one canonical form — this generator handles both independently so you can pick exactly one HTTPS policy and one host policy.

URL Rewriting for Frameworks

Most PHP frameworks and single-page apps route every request through one entry file (index.php or index.html) and handle routing internally in JavaScript or PHP — the .htaccess rewrite rule's job is simply to send every request that isn't a real file or directory to that entry point.

Security Rules

Beyond headers, .htaccess can deny access to specific files by pattern (<FilesMatch>), restrict access by IP (<RequireAll> with Require ip / Require not ip), and disable risky defaults like directory listing (Options -Indexes) — all without needing root access to the server.

Browser Caching & Gzip Compression

mod_expires tells browsers how long to keep a cached copy of a file before re-checking with the server — long for rarely-changing assets like images and fonts, short for HTML. mod_deflate compresses text-based responses (HTML, CSS, JS, JSON) before sending them, cutting transfer size significantly at negligible CPU cost.

Hotlink Protection

Hotlinking is when another site embeds your images directly, consuming your bandwidth for someone else's page. The generated rule checks the Referer header and blocks image requests that didn't originate from your own domain.

CORS

Cross-Origin Resource Sharing headers tell browsers which other origins are allowed to fetch a resource via JavaScript — necessary when your API or static assets are consumed from a different domain than they're hosted on.

PHP Directives via .htaccess

php_value and php_flag only work when PHP runs as an Apache module (mod_php). Increasingly common PHP-FPM setups (most modern managed hosting and Docker-based deployments) will reject these directives with a 500 Internal Server Error — use a .user.ini file or your host's control panel instead in that case.

Custom Error Pages

ErrorDocument directives let you show a branded page instead of Apache's default error screen for statuses like 404 (Not Found) or 500 (Server Error).

Common Errors & Troubleshooting

• 500 Internal Server Error right after upload — almost always a directive your host doesn't allow in .htaccess (ServerTokens, php_value on PHP-FPM) or a missing module; comment out sections one at a time to isolate it.
• Redirect loops — usually caused by a proxy/load balancer that already terminates HTTPS, so %{HTTPS} never reports "on"; check %{HTTP:X-Forwarded-Proto} instead on such setups.
• Rules seem ignored — confirm AllowOverride All (or at least the relevant override categories) is enabled for that directory in the main Apache config; some hosts restrict this.
• Pretty URLs 404 — confirm mod_rewrite is enabled on the server (a2enmod rewrite on Debian/Ubuntu) and the file has been uploaded exactly as .htaccess, not htaccess.txt.

Apache & Security Best Practices

• Always test a new .htaccess on a staging copy or with a quick rollback plan before deploying to production.
• Prefer <IfModule> wrappers for anything module-dependent, so a missing module doesn't take the whole site down.
• Keep sensitive-file protection and directory-listing rules on by default — they cost nothing and close common misconfiguration gaps.
• Only enable HSTS once you've confirmed HTTPS works reliably site-wide — it's difficult to quickly undo once cached by browsers.
• Combine HTTPS and www canonicalization goals, but understand two independent rules mean at most two redirect hops for the rare visitor hitting both wrong forms at once.

Privacy & Security

Every option you configure and every line of the generated file is built entirely inside your browser's JavaScript engine. Nothing is transmitted to ToolAdda's servers at any point.

Framework-Specific Rewrite Examples

These are the exact front-controller blocks generated by the Framework preset above, shown here for reference.

RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

RewriteEngine On
RewriteCond %{HTTP:Authorization} .
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ index.php [L]

RewriteEngine On
RewriteRule ^index\.html$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-l
RewriteRule . /index.html [L]

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php/$1 [L]

.htaccess vs. Apache VirtualHost Config

301 vs. 302 Redirects

Gzip vs. Brotli Compression

Related Developer Tools