.ht

.htaccess Generator

Generate Apache .htaccess rules for redirects, HTTPS enforcement, CORS, caching, security headers, and more. Toggle sections to include or exclude them from the output.

1. Basics▶

Disable directory listing

Options -Indexes

DirectoryIndex

2. Redirects▶

Force HTTPS

Redirect http:// → https://

Force www

Redirect non-www → www

Force non-www

Redirect www → non-www

Remove .html extension

Pretty URLs — /page instead of /page.html

Custom Redirects

FROMTOCODE

3. Security▶

Block .htaccess access

Deny all requests to this file

Block sensitive files

.git, .env, composer.json, package.json, wp-config.php

Block bad bots

AhrefsBot, MJ12bot, SemrushBot, and others

Disable ETags

FileETag None

Security Headers

X-Frame-Options: DENY

Prevent clickjacking

X-XSS-Protection

Enable XSS filter in older browsers

X-Content-Type-Options: nosniff

Prevent MIME type sniffing

Referrer-Policy

strict-origin-when-cross-origin

4. Performance / Caching▶

Enable gzip compression

mod_deflate — compress HTML, CSS, JS, JSON, SVG

Set Expires headers

Images: 1 year · CSS/JS: 1 month · HTML: 1 day

Enable Cache-Control headers

Immutable for images/fonts, 30d for CSS/JS, 1d for HTML

5. CORS▶

6. Custom Error Pages▶

.htaccess

# # ---- Basics ----
# Prevent directory listing
Options -Indexes
# Default index files
DirectoryIndex index.html index.php

# # ---- Redirects ----
<IfModule mod_rewrite.c>
  RewriteEngine On

#   Force HTTPS
  RewriteCond %{HTTPS} off
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

#   Custom redirects
  RewriteRule ^old-page$ /new-page [L,R=301]

</IfModule>

# # ---- Security ----
# Block access to .htaccess itself
<Files ".htaccess">
  Require all denied
</Files>

# Block access to sensitive files
<FilesMatch "(\.git|\.env|composer\.json|composer\.lock|package\.json|package-lock\.json|\.DS_Store|wp-config\.php)">
  Require all denied
</FilesMatch>

# Disable ETags
FileETag None

<IfModule mod_headers.c>
#   Prevent clickjacking
  Header always set X-Frame-Options "DENY"
#   Enable XSS filter in older browsers
  Header always set X-XSS-Protection "1; mode=block"
#   Prevent MIME type sniffing
  Header always set X-Content-Type-Options "nosniff"
#   Control referrer information
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# # ---- Performance / Caching ----
# Enable gzip compression
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/xml
  AddOutputFilterByType DEFLATE text/css text/javascript
  AddOutputFilterByType DEFLATE application/javascript application/x-javascript
  AddOutputFilterByType DEFLATE application/json application/xml
  AddOutputFilterByType DEFLATE image/svg+xml
</IfModule>

# Set Expires headers
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/html                "access plus 1 day"
  ExpiresByType text/css                 "access plus 1 month"
  ExpiresByType application/javascript   "access plus 1 month"
  ExpiresByType image/png                "access plus 1 year"
  ExpiresByType image/jpg                "access plus 1 year"
  ExpiresByType image/jpeg               "access plus 1 year"
  ExpiresByType image/gif                "access plus 1 year"
  ExpiresByType image/webp               "access plus 1 year"
  ExpiresByType image/svg+xml            "access plus 1 year"
  ExpiresByType font/woff2               "access plus 1 year"
</IfModule>

# # ---- Custom Error Pages ----
ErrorDocument 404 /404.html