Rules
Redirect and canonical URL
Used for HTTPS, www, HSTS and hotlink. Without it you can still generate rules that are not host-specific.
Force HTTP → HTTPS. Combined with the canonical host so you do not get a www chain.
The browser remembers HTTPS. Preload is hard to undo — only after the whole domain is HTTPS.
One hop: www and HTTPS resolve together so Google does not see two redirects.
Pick one canonical form: /page or /page/. Do not mix them in the sitemap.
301/308 = permanent (SEO). 302/307 = temporary. 307/308 keep the POST method.
One redirect per line: /old /new or /a → /b. Max 80. Comments start with #.
Security
If listing is on, anyone can see files in a folder with no index. Turn it off in production.
Blocks HTTP access to secrets. It does not replace disk permissions.
Stops the site being put in an iframe (clickjacking). DENY also blocks your own iframes.
How much of the URL is sent to other sites. strict-origin-when-cross-origin is the usual balance.
nosniff stops the browser guessing the file type. It reduces XSS on bad uploads.
Turns off geolocation, microphone and camera for third parties. It can break widgets that need access.
Stops other sites from embedding your images. An empty referrer is a bookmark or a quiet client — usually allowed.
Performance
Gzip (mod_deflate) shrinks HTML, CSS and JS. Needs the Apache module. Brotli is usually Nginx/CDN.
Fresh HTML + cached images/CSS/JS. Aggressive also caches HTML — avoid on frequently updated sites.
UTF-8 avoids broken characters. The font option adds woff/woff2 MIME types.
Pages and app
ErrorDocument sends 404/403/500 to your own file. The file must exist on the server.
Which file is served on /. Laravel/WordPress: index.php first. Static site: index.html first.
Sends missing routes to index.php. Laravel also needs -MultiViews. On a static site this can break pages.
.htaccess file
Rules0
Redirects0
Status—
How this .htaccess generator works
Every rule is a dropdown: off, or a concrete variant (301 vs 302, 1-year HSTS vs preload, balanced vs aggressive cache). The tool writes an Apache .htaccess. Put it in the site root, next to robots.txt and sitemap.xml.
HTTPS and www sit in one rule so you avoid a redirect chain. Headers, gzip and cache need Apache modules (headers, deflate, expires). A front controller to index.php is for Laravel/PHP, not static HTML.
Redirect
301, 302, 307, 308
Permanent or temporary. 307/308 keep POST. One hop for HTTPS + www.
Security
Headers and files
Pick X-Frame, Referrer, nosniff, HSTS, listing and which secrets to block.
Speed
Gzip and cache
No HTML cache, assets for a year — or cache everything if you accept the risk.
Important:
Apache only. HSTS preload is hard to remove. Front controller + a static site = dead pages. Test on staging before production.
Useful notes
- Put `.htaccess` in the domain root, next to robots.txt and sitemap.xml.
- 301/308 move SEO signals. 302/307 do not promise a permanent transfer.
- File order: canonical, slash, path list, hotlink, then index.php.
- Strict file blocking also covers composer.json — on some setups that file is meant to be public.
- Nothing is saved on the server. Reloading the page clears the fields.