Skip to main content

htaccess generator

Build Apache .htaccess configuration from a library of common directives.

Free & unlimited
Features
Force HTTPS — settings
Browser caching — settings
Default cache duration (days)
Custom rules
All processing happens in your browser. No data is sent to any server.

Nine of the directive blocks that end up in almost every Apache .htaccess file are here as checkboxes, and the file assembles itself in the panel beside them, syntax-highlighted and commented, as you tick. Three are on when the page loads — force HTTPS, security headers and browser caching — because those are the three most sites are missing. Four of the blocks open a small settings field when enabled: the www preference on the HTTPS redirect, the default cache duration in days, the domain to allow for hotlink protection, and the paths of your 404 and 500 pages. Anything the presets do not cover goes in as a named custom block, which is appended verbatim with its own comment header. The result copies to the clipboard or downloads as a file already called .htaccess.

Key facts about htaccess generator

Key facts about htaccess generator
Directive blocks offered9 — force HTTPS, gzip compression, browser caching, HSTS, security headers, hotlink protection, SPA fallback, custom error pages and blocking sensitive files
Enabled by defaultForce HTTPS, security headers and browser caching
HTTPS ruleRewriteCond on %{HTTPS} off with a 301 RewriteRule, plus an optional second condition that also forces the www prefix
Security headers writtenX-Content-Type-Options nosniff, X-Frame-Options SAMEORIGIN, X-XSS-Protection, Referrer-Policy strict-origin-when-cross-origin, and a Permissions-Policy that denies camera, microphone and geolocation
HSTS valuemax-age=31536000 with includeSubDomains — one year, no preload directive
Caching blockmod_expires with your chosen default in days, plus one-year overrides for CSS, JavaScript, JPEG, PNG, SVG and WOFF2
Gzip blockmod_deflate on HTML, plain text, CSS, JavaScript, JSON, XML and SVG
Hotlink protectionBlocks jpg, jpeg, png, gif, svg and webp requests whose referer is neither empty nor your domain, returning 403
Blocked file patternsA FilesMatch covering .htaccess, .htpasswd, .env and .git
Module guardsThe gzip, caching, HSTS and header blocks are wrapped in IfModule, so the file does not 500 on a server without mod_deflate, mod_expires or mod_headers
Custom rulesAny number of named free-text blocks, appended in order with a comment header each
Not generatedPer-URL 301 redirects, password protection with AuthUserFile, IP allow and deny lists, and PHP value overrides — write those as custom rules
Preview visibilityThe highlighted preview panel is shown on wide screens only; on a phone you get the copy and download buttons instead

What happens to your file

There is no server in this loop. Each block is a template string in the page bundle; ticking a box concatenates it into the output, and the settings fields are substituted straight into the text. The file you download is built from a Blob made in the tab and handed to a temporary link, so the bytes never travel anywhere. Nothing you type — your domain name for hotlink protection, your error page paths, any custom rule you paste in — is transmitted, logged or stored, and a page refresh resets everything to the three default blocks. The page keeps working offline once loaded.

About this tool

  1. 1

    Start with the three defaults

    Force HTTPS, security headers and browser caching are already ticked. If you only came for the basics, the file in the preview is finished and you can copy it now.

  2. 2

    Tick what else you need

    Add gzip if compression is not already handled upstream, SPA fallback if a single-page app needs every path routed to index.html, and blocking of sensitive files if .env or .git might be reachable.

  3. 3

    Fill the settings that appear

    Enabling hotlink protection asks for the domain to allow. Caching asks for a default duration in days. Custom error pages ask for your 404 and 500 paths. HTTPS asks whether www should be forced too.

  4. 4

    Add anything missing as a custom rule

    Use Add custom rule for redirects of individual URLs, password protection or anything else the checkboxes do not cover. Give it a name — it becomes the comment above the block.

  5. 5

    Read the preview before you trust it

    Every block carries a comment saying what it does. A rewrite rule you cannot explain is a rewrite rule you should not deploy, because .htaccess errors take the whole site down with a 500.

  6. 6

    Upload and verify

    Download the file, put it in your document root, then load the site in a private window. Check that http redirects to https once and not in a loop, and that the headers you asked for appear in the network panel.

Specs & compatibility
Target serverApache HTTP Server 2.4, with mod_rewrite, mod_headers, mod_expires and mod_deflate where those blocks are used
PrerequisiteAllowOverride must permit the directives — on a shared host it usually does; on your own server the default in many distributions is AllowOverride None
Not forNginx, Caddy, IIS and LiteSpeed in its native configuration — .htaccess is an Apache mechanism
OutputPlain text with comment headers per block, starting with a generated-by line
Download file name.htaccess, with a leading dot — some operating systems hide it in the file manager afterwards
Upload locationThe document root for site-wide rules, or any subdirectory to scope the rules to that folder and below
Syntax highlightingAround 24 recognised directive keywords, with strings and numbers coloured separately
NetworkNone after page load
  • Back up the existing .htaccess before you replace it. WordPress, Laravel and most CMS installers write their own rewrite block into that file, and pasting over it breaks routing instantly.
  • Keep this file small on a busy site. Apache reads .htaccess on every request, and in every parent directory of the requested path — configuration in the main server config or a vhost is parsed once instead.
  • Never enable HSTS until HTTPS works on every subdomain you own. The includeSubDomains directive is remembered by the browser for a year, and a subdomain still on plain HTTP becomes unreachable for that whole period.
  • Test the HTTPS redirect from behind a proxy or CDN before you rely on it. A terminating proxy often leaves %{HTTPS} off on the origin, which turns the rule into a redirect loop.
  • The hotlink rule allows an empty referer on purpose: without that, direct image loads, some privacy extensions and several browsers would be blocked from your own images.
  • Setting a one-year cache on CSS and JavaScript is only safe if your build puts a hash in the file name. Without cache busting, a returning visitor keeps the old bundle for a year.
  • The IfModule wrappers mean a missing module silently skips a block rather than crashing the server — which also means a header you cannot find may just be a module that is not loaded. Check with apachectl -M.
  • If nothing at all takes effect, the usual cause is AllowOverride None in the server configuration; on your own server the file is simply ignored until that is changed.
  • Nine ready directive blocks
  • Per-block settings fields
  • IfModule guards on module-dependent blocks
  • Named custom rule blocks
  • Syntax-highlighted live preview
  • Copy to clipboard
  • Download as .htaccess
  • Force every visitor onto HTTPS after installing a certificate.
  • Add the standard security headers a penetration test or a security scanner asked for.
  • Give a single-page app the rewrite fallback it needs so deep links stop returning 404.
  • Stop other sites from embedding your images and burning your bandwidth.
  • Set sensible cache lifetimes on static assets to cut repeat-visit load time.
  • Make sure .env and .git are not readable over the web on a shared host where you cannot change the server configuration.
In the directory whose requests you want the rules to apply to. For site-wide rules that is the document root — public_html, htdocs, www or whatever your host calls it. Rules also apply to every subdirectory below, and a second .htaccess deeper in the tree overrides them for that branch. The file name starts with a dot, so your FTP client or file manager may hide it until you enable showing hidden files.
Two causes cover most cases. The first is AllowOverride: Apache only honours .htaccess directives that the server configuration permits, and the default in several distributions is AllowOverride None, which makes the file inert. On shared hosting it is normally set to All or FileInfo. The second is that a module is missing — the IfModule guards mean a block with no mod_headers or mod_expires present is skipped silently rather than raising an error.
Not from the checkboxes — the only redirect the presets produce is the HTTPS and www canonicalisation. For per-URL moves, add a custom rule and write them as Redirect 301 /old-path /new-path, one per line, or use RedirectMatch with a regular expression for a pattern. Put those before the SPA fallback block if you use one, since the fallback rule matches everything that is not a real file.
No. .htaccess is an Apache feature: it is a per-directory configuration file that Apache reads at request time, and Nginx has no equivalent by design — its configuration is read once at startup. Nginx also uses different directive names for the same outcomes, so the syntax will not translate line by line. Use an Nginx server-block generator instead, and if you are on LiteSpeed, note that it reads .htaccess for compatibility while Caddy and IIS do not.
Rename or delete the .htaccess file and the site will come back immediately — a syntax error, or a directive from a module that is not loaded and not wrapped in IfModule, makes Apache refuse every request in that directory. Then add the blocks back a few at a time to find the offender, and check the Apache error log, which names the exact line. This is why replacing an existing file without a backup is risky on a live site.
No. The generator is string assembly in your browser: each ticked block is a template held in the page bundle, your settings are substituted into it, and the download is created from an in-memory blob. Nothing is posted, nothing is stored between visits, and there is no account. That matters for custom rules in particular, since people paste real paths, real domains and occasionally credentials into that box.

Related tools

View all

Updated

We use anonymous analytics to improve ToolChamp. No personal data is stored or sold. Privacy Policy