.htaccess generator for Apache — HTTPS, redirects, caching, headers

How to use the .htaccess generator

1. Choose Force HTTPS and the www handling: Leave as is, www → bare domain, or Bare → www.
2. List Redirects (old-path new-url [302]), one per line, for example /old-page /new-page.
3. Tick Single-page app fallback if your site is a React, Vue or similar app.
4. Choose Disable directory listings, Block dotfiles (.git, .env), Compression (mod_deflate), Browser caching (mod_expires), Security headers and HSTS.
5. Set a Custom 404 page, then upload the result as .htaccess to your site’s root folder.

What it does and when to use it

An .htaccess file changes how Apache serves one folder and everything below it, without access to the main server config. Shared hosts rely on it for HTTPS redirects, clean URLs and caching rules.

Use it when you move a site to HTTPS, change page addresses or deploy a single-page app to Apache hosting. On nginx, use the nginx config generator instead. Protect a folder with a password using the .htpasswd generator, and keep crawlers out of private paths with the robots.txt generator. Apache’s own .htaccess tutorial explains how overrides work.

How it works

The file is written in a fixed order, each module wrapped in <IfModule> so a missing module is skipped instead of breaking the site:

1. Options -Indexes and ErrorDocument 404.
2. A mod_rewrite block: the HTTPS rule, the www rule and the SPA fallback (serve index.html when no real file or folder matches).
3. Your redirects as Redirect 301 or Redirect 302 lines. A path without a leading / gets one.
4. A FilesMatch rule that denies dotfiles but allows .well-known, which certificate checks need.
5. Compression, a one-year cache for CSS, JavaScript, images and fonts (HTML is not cached), and the headers.

Worked examples

Default rules. HTTPS forced, www removed, two redirects. The rewrite section reads:

  # Force HTTPS
  RewriteCond %{HTTPS} off
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  # www → bare domain
  RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
  RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]

followed by Redirect 301 /old-page /new-page and the second redirect.

Single-page app. SPA ticked, no redirects, www left as is, caching, compression and headers off. The rewrite block ends with two RewriteCond lines and RewriteRule ^ index.html [L].

A temporary redirect and a typo. Redirects /promo https://shop.example.com/sale 302 and broken-line. The first becomes Redirect 302 /promo https://shop.example.com/sale; the second is skipped with the warning that it needs an old path and a new URL. HSTS without Force HTTPS adds a second warning.

Limits and tips

• The www rules keep the visitor’s scheme (%{REQUEST_SCHEME}) when Force HTTPS is off, and go straight to https:// when it is on.
• When any redirect line uses 302, the comment above the redirects reads “301 permanent, 302 temporary” instead of “Permanent redirects”.
• Test redirects in a private window; browsers cache 301s.
• Back up the old .htaccess first; a CMS such as WordPress may keep its own rules there.