Htaccess Generator

⭐ Htaccess Generator: Apache Configuration Guide

This htaccess generator builds a downloadable Apache configuration from the options you choose. An .htaccess file applies per-directory rules on servers that allow overrides. This tool creates root-level rules for Apache 2.4 or newer; it does not configure Nginx or change your hosting settings.

⚙️ Generate an .htaccess file step by step

1. Select only the options your website needs. Enter your real domain for HTTPS, www redirects or hotlink protection.
2. Add exact old and new paths for page redirects. Choose 302 while testing and 301 for permanent moves.
3. Review the live preview, validation errors and deployment warnings.
4. Copy the result or download .htaccess. Back up the existing file and merge carefully on staging first.
5. Test redirects, assets, login pages and error responses before deploying to production.

🔁 Example: HTTPS and a non-www domain

For example.com, select Force HTTPS and Remove www. Both http://www.example.com/page and http://example.com/page redirect to https://example.com/page. Paths and query strings are preserved. These rules assume that Apache itself handles HTTPS; a reverse proxy needs host-specific trusted proxy configuration.

🔎 Example: redirect an old page

Enter /old-page as the source and /new-page as the destination. Only that exact path matches: /old-page/child is not redirected. A request to /old-page?ref=email keeps the query string, unless your destination provides a replacement query. Encode spaces in paths as %20. Avoid redirect chains; the generator rejects duplicate sources and detectable local loops, including loops through www/non-www variants when hostname or HTTPS redirects are enabled. Double slashes in source and destination paths are rejected, including URL-encoded variants, because Apache normally merges them. The generator cannot inspect redirects on other servers.

RewriteEngine On
RewriteRule "^old-page$" "/new-page" [R=301,END,NE]

📁 Redirect a directory and its subpaths

Select Directory and subpaths, enter /old-folder and /new-folder. Requests to /old-folder/photos/my%20photo.jpg?size=large redirect to /new-folder/photos/my%20photo.jpg?size=large, preserving the encoded suffix and query. Destinations may be external HTTP(S) URLs but cannot contain a query or fragment in directory mode. Root-level directory moves are not supported. Exact redirects run before directory rules, with the longest matching directory first. The generator checks detectable cycles between both kinds of rules, but existing server rules can still cause loops.

🔐 Password protection and local .htpasswd generation

Enable Basic authentication for the entire site or one filename, such as private.html. Supply an absolute deployment path to a password file outside the public document root, for example /home/account/private/.htpasswd. Enter a username and password and choose Generate .htpasswd locally. A bundled BSD-licensed bcryptjs 3.0.2 library hashes the password in your browser with a random salt and cost 12; no hashing request is sent to the server. The output uses Apache's $2y$ bcrypt format and can be copied or downloaded as a single-entry password file.

Passwords must be 8-72 UTF-8 bytes to avoid bcrypt's silent truncation, and usernames cannot contain colons or line breaks. Generating another entry replaces the previous output. Merge entries manually if you need multiple users, taking care not to duplicate usernames. The password field is cleared after successful generation. Changing credentials or choosing Clear invalidates any pending result. Copy history is disabled for this whole tool; passwords and hashes are not persisted to localStorage. Always serve Basic authentication over HTTPS. Apache needs mod_auth_basic, mod_authn_file and mod_authz_user.

🚧 IP allow lists, block lists and bot filtering

Enter comma- or newline-separated IPv4/IPv6 addresses or CIDR ranges, such as 192.0.2.10, 198.51.100.0/24 or 2001:db8::/32. A nonempty allow list denies everyone not listed; blocks take precedence even over allowed addresses. When password protection is enabled, allowed visitors must still authenticate. These rules use Apache 2.4 Require directives, not legacy Order/Allow/Deny syntax. Behind a proxy, the host must configure trusted client IP handling before these rules are useful. Keep a recovery path so you do not lock yourself out.

Bot filtering blocks literal, case-insensitive user-agent substrings that you specify. It is opt-in and does not automatically block search engines. Clients can forge user agents, so these checks are only a traffic filter, not a security boundary.

📄 Custom error pages and default directory pages

Set local error documents for HTTP 400, 401, 403, 404 and 500, for example /errors/404.html. Use existing root-relative files, not external redirects, to retain the original error status. Test that IP restrictions, Basic authentication and rewrite rules do not block the error document itself. The default directory setting accepts an ordered list such as index.html index.php. The first existing filename is served. Leaving it blank keeps your host's defaults; SPA fallback still targets index.html.

🛡️ Security headers and file access

MIME-sniffing protection, same-origin framing and a referrer policy add focused browser protections. File-access rules deny dotfiles, hidden directories and common configuration, database, log and backup filenames. The public /.well-known/ directory remains available for certificate validation, but hidden and sensitive files inside it are still blocked. These patterns are not a complete secret scanner: keep credentials and private backups outside the document root.

HSTS instructs browsers to use HTTPS for one year after receiving the header over HTTPS. Enable it only when you can maintain valid HTTPS. This generator deliberately omits includeSubDomains and preload. Hiding the server signature affects generated error pages, not the server's HTTP Server header.

🚀 Gzip and browser caching

Gzip compresses text-based responses using mod_deflate and mod_filter. Browser caching matches the file extensions you select, with CSS, JavaScript, images and fonts as defaults. Choose a preset or a custom duration in minutes, hours, days, weeks or 30-day months, up to one year. Public caching allows shared caches; private caching restricts storage to the browser. Must-revalidate requires validation when a cached response becomes stale, not on every request. Password protection requires private caching in this generator.

The generated rules use mod_expires and mod_headers. For example, 30-day caching reduces repeat downloads, while versioned asset names such as app.v2.css deliver updates. Do not publicly cache personalized HTML, PHP or JSON responses. Optional module blocks are skipped if their modules are unavailable; verify response headers to confirm that each feature is active.

🖼️ Hotlink protection and SPA fallback

Hotlink rules protect the extensions you select while allowing your domain, its www counterpart and requests without a referrer. Leave the referring-domain list blank to block all external referrers, or specify only the domains and subdomains to block. You can return HTTP 403 or redirect to an existing local replacement image or external HTTPS image. A local replacement is excluded from the hotlink check to prevent a loop. This may affect legitimate embeds and does not stop clients that forge referrers.

The single-page application option rewrites missing routes to an existing index.html, while leaving real files, directories and certificate-validation paths alone. Enable it only for a root-hosted static app, not alongside WordPress or another front controller.

⚠️ Hosting requirements and safe deployment

Place the file at the website's document root. Your host must enable the required modules and permit FileInfo, Options and/or Indexes overrides for the features selected. Missing rewrite support or forbidden directives can cause HTTP 500 errors. Restore the backup and read the Apache error log if this happens. Keep application-managed blocks intact and review rule order: access restrictions come first, then canonical and custom redirects, hotlink checks and finally SPA fallback.

All configuration inputs and password hashing are processed locally. This tool does not upload your inputs or write files to your server. The site's shared copy-history feature is disabled on this tool, including for generated hashes. Downloads are saved to your device; deploy the reviewed files yourself after testing.

This tool is also known as

• htaccess file generator online
• apache htaccess configuration generator
• htaccess https redirect generator
• htaccess 301 redirect generator
• generate htaccess security and cache rules