.htaccess Generator — Free Online Tool

What is .htaccess Generator & Validator (Apache)?

.htaccess is an Apache web server configuration file that controls URL redirects, rewrites, security headers, caching, authentication, and more for websites hosted on Apache. This tool generates .htaccess rules for common scenarios — redirect www to non-www, enforce HTTPS, enable gzip compression, set cache headers, block IPs, custom error pages, URL rewrites (SEO-friendly URLs). Select rule type, configure options, and copy the .htaccess code. Validates syntax, warns about conflicting rules, and suggests best practices (security headers, performance optimizations).

An .htaccess file is a directory-level Apache configuration file interpreted when requests reach that directory. It can define redirects, URL rewrites, authentication, caching, compression, and headers without changing the main server config, although its availability depends on Apache AllowOverride settings. Rule order matters: an early redirect or rewrite can change the request before later rules get a chance to run.

• Redirect rules: 301/302 redirects: www to non-www (or vice versa), HTTP to HTTPS, old URLs to new URLs, domain changes. Uses mod_alias or mod_rewrite.
• URL rewriting: SEO-friendly URLs: /product/123 → product.php?id=123, remove .php extensions, trailing slash handling. Uses mod_rewrite.
• Security headers: Set HTTP headers: X-Frame-Options (prevent clickjacking), Content-Security-Policy (XSS protection), X-Content-Type-Options (MIME sniffing), Strict-Transport-Security (HSTS).
• Caching and compression: Browser caching (Cache-Control, Expires), gzip compression (mod_deflate), ETags. Improves page load speed.
• Access control: Block IPs (Deny from), password protect directories (AuthType Basic), allow/deny by user-agent or referer.

Why use .htaccess generator?

Writing .htaccess rules manually requires knowledge of Apache directives, regex, and module dependencies. This tool generates rules with correct syntax.

• Avoid syntax errors: .htaccess syntax is strict (regex patterns, RewriteCond, RewriteRule). Typos cause 500 Internal Server Error. Tool validates syntax.
• Save time: No need to search Apache docs for directive syntax or regex patterns. Tool generates production-ready rules instantly.
• Learn .htaccess syntax: See how RedirectMatch, RewriteRule, Header, FilesMatch work. Great for learning Apache configuration.
• Security best practices: Tool sets security headers (HSTS, CSP, X-Frame-Options), prevents directory listing, blocks hotlinking.
• Performance optimization: Enables gzip compression, browser caching, ETags. Reduces page load time by 30-70%.
• SEO-friendly URLs: Rewrite rules for clean URLs (/about instead of about.php). Better for SEO and user experience.

When to use .htaccess generator

Use whenever you need to configure Apache web server behavior for a website.

• Redirecting www to non-www (or vice versa) for SEO canonicalization.
• Enforcing HTTPS (redirect HTTP to HTTPS) for security.
• Creating SEO-friendly URLs (rewrite /product/123 to product.php?id=123).
• Setting security headers (HSTS, CSP, X-Frame-Options) to prevent attacks.
• Enabling gzip compression and browser caching for faster page loads.
• Blocking IPs, user-agents, or hotlinking (prevent image theft).
• Creating custom error pages (404, 500) for better UX.

How to use .htaccess generator

Select rule type, configure options, generate .htaccess code.

1. Choose rule type: Select from dropdown: Redirect (301/302), HTTPS enforcement, URL rewrite, security headers, caching, gzip, IP block, error pages, or custom.
2. Configure redirect (if applicable): Set source URL (old path) and target URL (new path). Choose 301 (permanent) or 302 (temporary). Example: /old-page → /new-page.
3. Set rewrite rules (if applicable): Define URL pattern and rewrite target. Example: /product/([0-9]+) → product.php?id=$1. Uses regex for pattern matching.
4. Add security headers (optional): Enable HSTS (force HTTPS), CSP (prevent XSS), X-Frame-Options (prevent clickjacking), X-Content-Type-Options (no MIME sniffing).
5. Enable performance features (optional): Turn on gzip compression (text/html, text/css, application/javascript), browser caching (Cache-Control, Expires), ETags.
6. Validate .htaccess: Click Validate to check syntax errors, conflicting rules, missing modules (mod_rewrite, mod_deflate, mod_headers).
7. Copy .htaccess code: Click Copy to get the .htaccess rules. Paste into .htaccess file in website root or subdirectory. Upload to server via FTP/SFTP.

Key features

• Redirect generator: 301/302 redirects for www, HTTPS, URL changes. Uses Redirect or RewriteRule.
• URL rewrite builder: SEO-friendly URLs, remove file extensions, trailing slash handling. Regex-based rewrites.
• Security headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy. Prevents clickjacking, XSS, MIME sniffing.
• Performance optimization: Gzip compression (mod_deflate), browser caching (Cache-Control, Expires), ETags. Reduces load time.
• Access control: Block IPs (Deny from), password protect (AuthType Basic), user-agent filtering, referer checking.
• Custom error pages: Set ErrorDocument for 404, 500, 403. Redirect to custom HTML pages for better UX.
• Syntax validation: Checks .htaccess syntax, warns about missing modules, detects conflicting rules.

Common use cases

• Redirect www to non-www: RewriteCond %{HTTP_HOST} ^www\.example\.com, RewriteRule ^(.*)$ https://example.com/$1 [R=301,L]. SEO canonicalization.
• Force HTTPS: RewriteCond %{HTTPS} off, RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]. Redirects HTTP to HTTPS.
• Remove .php extension: RewriteCond %{REQUEST_FILENAME}.php -f, RewriteRule ^(.*)$ $1.php [L]. /about → about.php (SEO-friendly).
• Set HSTS header: Header always set Strict-Transport-Security 'max-age=31536000; includeSubDomains'. Forces HTTPS for 1 year.
• Enable gzip compression: AddOutputFilterByType DEFLATE text/html text/css application/javascript. Compresses files before sending.
• Block IP address: Deny from 192.168.1.1. Blocks specific IP from accessing website.

Examples

.htaccess rules generated by this tool.

Type: Redirect, Source: www.example.com, Target: example.com, Code: 301

RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.example\.com$ [NC]
RewriteRule ^(.*)$ https://example.com/$1 [R=301,L]

Type: HTTPS enforcement

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

Type: URL rewrite, Extension: .php

RewriteEngine On
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^(.*)$ $1.php [L]

Type: Security header, Header: HSTS, Max-age: 31536000

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

Type: Performance, Feature: gzip

AddOutputFilterByType DEFLATE text/html text/css text/javascript application/javascript application/json

Technical reference

.htaccess directives and modules:

File location

Place .htaccess in website root (/public_html, /var/www/html) or subdirectory. Rules apply to that directory and subdirectories. Hidden file (starts with dot).

Redirect (mod_alias)

Simple redirects: Redirect 301 /old-page /new-page. 301 = permanent, 302 = temporary. Or RedirectMatch 301 ^/old-page$ /new-page (regex).

RewriteEngine (mod_rewrite)

Enables URL rewriting: RewriteEngine On. Required before RewriteRule/RewriteCond. Most powerful module for redirects and rewrites.

RewriteRule

URL rewrite: RewriteRule ^product/([0-9]+)$ product.php?id=$1 [L]. Pattern (regex) → Target. Flags: L (last), R=301 (redirect), NC (case-insensitive).

RewriteCond

Condition for RewriteRule: RewriteCond %{HTTPS} off (if HTTPS is off). Runs RewriteRule only if condition is true. Multiple conditions = AND (default) or [OR].

Header (mod_headers)

Set HTTP headers: Header set X-Frame-Options 'DENY'. Used for security headers (HSTS, CSP), caching (Cache-Control), CORS.

AddOutputFilterByType (mod_deflate)

Enable gzip compression: AddOutputFilterByType DEFLATE text/html text/css. Compresses responses before sending. Reduces bandwidth.

ErrorDocument

Custom error pages: ErrorDocument 404 /404.html. Redirects 404 (Not Found) to custom page. Common: 404, 500, 403.

Deny/Allow (mod_authz_host)

Access control: Deny from 192.168.1.1 (block IP), Allow from all (allow all). Order matters: Order Deny,Allow.

Flags ([L], [R=301], [NC])

RewriteRule flags: L (last rule, stop processing), R=301 (301 redirect), NC (case-insensitive), QSA (append query string). Example: [R=301,L,NC]

Common mistakes to avoid

Forgetting RewriteEngine On before RewriteRule, causing redirects to fail silently

Why it happens: RewriteEngine On must appear before any RewriteRule or RewriteCond. Without it, mod_rewrite is disabled and rules don't run. Common for beginners who copy individual rules without the header.

How to avoid it: Always add RewriteEngine On as the first line when using RewriteRule or RewriteCond. Tool adds this automatically.

Creating infinite redirect loops (redirecting A to B, B to A)

Why it happens: Example: RewriteRule ^old$ /new [R=301] and RewriteRule ^new$ /old [R=301]. Browser gets stuck in infinite loop (ERR_TOO_MANY_REDIRECTS). Common when multiple redirects conflict.

How to avoid it: Use RewriteCond to prevent loops. Example: RewriteCond %{REQUEST_URI} !^/new$ before redirecting to /new. Or check %{HTTPS} is off before HTTPS redirect.

Using .htaccess on Nginx server, causing it to be ignored

Why it happens: .htaccess is Apache-only. Nginx does not read .htaccess files. Rules must be in nginx.conf or site config. Common when migrating from Apache to Nginx without reconfiguration.

How to avoid it: For Nginx, use nginx.conf with rewrite directives or return statements. Convert .htaccess rules to Nginx syntax (different format). Use online converters or write manually.

Hardcoding domain names in RewriteRule, breaking on dev/staging environments

Why it happens: RewriteRule ^(.*)$ https://example.com/$1 hardcodes example.com. Breaks on localhost, staging.example.com, or dev environments. Common when copying production .htaccess to dev.

How to avoid it: Use %{HTTP_HOST} instead: RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1. This uses the current domain dynamically (works on localhost, staging, production).

Not testing .htaccess changes, causing 500 Internal Server Error in production

Why it happens: Syntax errors (.htaccess typo, wrong regex, missing module) cause 500 error (website down). Testing in production = downtime. Common when deploying unvalidated .htaccess.

How to avoid it: Test .htaccess locally (XAMPP, MAMP, Docker with Apache). Check Apache error log (error.log) for syntax errors. Or validate with tool before uploading to production.

Frequently asked questions

Where do I put the .htaccess file?

Website root (/public_html, /var/www/html, or wherever index.php is). Rules apply to that directory and all subdirectories. Hidden file (starts with dot). Upload via FTP/SFTP.

What is the difference between Redirect and RewriteRule?

Redirect (mod_alias) is simple: Redirect 301 /old /new. RewriteRule (mod_rewrite) supports regex, conditions, flags: RewriteRule ^old$ /new [R=301,L]. Use Redirect for simple, RewriteRule for complex.

How do I redirect HTTP to HTTPS?

RewriteEngine On, RewriteCond %{HTTPS} off, RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]. Redirects all HTTP to HTTPS. 301 = permanent.

How do I redirect www to non-www (or vice versa)?

www to non-www: RewriteCond %{HTTP_HOST} ^www\., RewriteRule ^(.*)$ https://example.com/$1 [R=301,L]. non-www to www: RewriteCond %{HTTP_HOST} !^www\., RewriteRule ^(.*)$ https://www.example.com/$1 [R=301,L].

Why do I get 500 Internal Server Error after uploading .htaccess?

Syntax error in .htaccess (typo, wrong regex, missing RewriteEngine On) or required module not enabled (mod_rewrite, mod_headers). Check Apache error log (error.log) for details.

Does .htaccess work on Nginx?

No. .htaccess is Apache-only. Nginx uses nginx.conf or site config files. Convert .htaccess rules to Nginx syntax (different format).

How do I enable mod_rewrite on Apache?

Ubuntu/Debian: sudo a2enmod rewrite && sudo systemctl restart apache2. CentOS/RHEL: Edit httpd.conf, uncomment LoadModule rewrite_module, restart Apache. Shared hosting: contact host (usually enabled).

References

• Apache .htaccess Tutorial
• mod_rewrite Guide
• .htaccess Cheat Sheet
• Apache Directives