Htaccess Generator

The Htaccess Generator creates Apache .htaccess configuration files for common site-management tasks: redirects (301/302), URL rewriting, canonical redirects (www/non-www, HTTP to HTTPS, trailing slash), password protection, IP blocking, compression, browser caching, security headers, and custom error pages. Apache is still widely used (shared hosting, WordPress hosting, LAMP stack sites) and .htaccess is the standard way to configure per-directory rules without editing the main server config.

Configure via structured forms — pick what you want (redirect, password protect, gzip, etc.), fill in parameters, and the tool generates syntactically correct .htaccess output. Presets cover common scenarios: force HTTPS, redirect www to non-www (or vice versa), block specific IPs, password protect a directory, enable compression and caching, add security headers like X-Frame-Options and Content-Security-Policy. All generation runs client-side — server paths and IP addresses stay in your browser.

.htaccess uses Apache directive syntax. Common sections:

RewriteEngine On — required to enable mod_rewrite.

Redirects (permanent vs temporary):

Redirect 301 /old-path https://example.com/new-path

RewriteRule variant (more flexible):

RewriteRule ^old-path/?$ /new-path [R=301,L]

Force HTTPS:

RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Force www (or non-www):

RewriteCond %{HTTP_HOST} ^example\\.com$ [NC]
RewriteRule ^(.*)$ https://www.example.com/$1 [R=301,L]

Password protection (Basic Auth):

AuthType Basic
AuthName \"Restricted Area\"
AuthUserFile /path/to/.htpasswd
Require valid-user

The .htpasswd file contains hashed credentials separately.

IP blocking:

<RequireAll>
Require all granted
Require not ip 192.0.2.1
Require not ip 203.0.113.0/24
</RequireAll>

Compression (mod_deflate):

<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript application/json
</IfModule>

Browser caching (mod_expires):

<IfModule mod_expires.c>
ExpiresActive On
ExpiresByType image/jpg \"access plus 1 year\"
ExpiresByType image/png \"access plus 1 year\"
ExpiresByType text/css \"access plus 1 month\"
ExpiresByType application/javascript \"access plus 1 month\"
</IfModule>

Security headers:

Header set X-Frame-Options SAMEORIGIN
Header set X-Content-Type-Options nosniff
Header set Strict-Transport-Security \"max-age=31536000; includeSubDomains\"

Custom error pages:

ErrorDocument 404 /404.html
ErrorDocument 500 /500.html

Directory index:

DirectoryIndex index.html index.php

Hotlink protection (prevent others from embedding your images):

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^https?://(www\\.)?example\\.com/ [NC]
RewriteRule \\.(jpg|jpeg|png|gif)$ - [F,NC]

Limits:
- .htaccess is parsed on every request, adding latency. For performance, move rules to main Apache config when possible
- .htaccess requires AllowOverride in main config to work
- Complex rules can become hard to debug; test thoroughly

nginx doesn\u2019t use .htaccess. For nginx, these rules go in the server block.

Compared to writing .htaccess by hand, this tool provides structured forms and valid syntax. Hand-writing is possible but error-prone for complex rules.

Compared to CMS security plugins (iThemes, Wordfence), this tool gives low-level control over Apache configuration. Plugins offer application-level security; .htaccess works at the server level.

Compared to nginx configuration tools, this tool is Apache-specific. For nginx, use nginx-specific configuration generators instead.