⌘ K
apache · htaccess · redirects · rewrite

Generate .htaccess rules

Compose HTTPS, www, redirect and deny rules for Apache. Assembly runs locally — paste the result into your project's .htaccess.

.htaccess Generator
Lines
24
total
Directives
14
active
Size
521 B
rule body
HTTPS
forced
redirect
Apache 2.4+ syntax · drop in document root
input · options
output · .htaccess
RewriteEngine On

# Force HTTPS
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Remove www.
RewriteCond %{HTTP_HOST} ^www\.example\.com$ [NC]
RewriteRule ^(.*)$ https://example.com/$1 [L,R=301]

# Custom redirects
Redirect 301 /old-page /new-page
Redirect 302 /another-old /another-new

# Deny access to sensitive files
<FilesMatch "\.git">
  Require all denied
</FilesMatch>
<FilesMatch "\.env">
  Require all denied
</FilesMatch>

# Disable directory listing
Options -Indexes
Quick Start

How to use .htaccess

Apache reads .htaccess on every request inside its containing directory. Keep rules minimal for performance.

  1. 01

    Pick canonical host

    Choose www or apex and force HTTPS — search engines pick one canonical.

    Lookups reference the IANA registries (MIME, HTTP status, TLDs) bundled at build time — no live network calls, no rate limits, no leaked queries.

    canonIANAregistryofflinelive
    canon · queryset · IANA
    R=301
    loaded · IANA bundlespec · ready
  2. 02

    Add redirects

    One per line: source target status. 301 for permanent, 302 for temporary.

    Builders emit canonical syntax per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs) so the output passes spec-compliant parsers.

    redirectRFC 9110canonicalspec-compliantlive
    old → new · options301 · live
    Redirect 301 /old /new
    options applied · livecanonical
  3. 03

    Deny sensitive files

    Block requests to .env, .git, etc. with FilesMatch.

    Validation flags common pitfalls — uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8 — before they bite production.

    denyvalidationlintpitfallslive
    deny · looked uppatterns · ready
    <FilesMatch "\.env">
    result · livevalidated
  4. 04

    Deploy

    Save as .htaccess in your document root. Apache reloads automatically.

    Copy writes the snippet directly into your clipboard; downloads emit the right extension and MIME so curl/httpie pick them up correctly.

    shipclipboardMIME-correctblobcurl-ready
    ok · copiedready · done
    Options -Indexes
    shipped · ready to shipsuccess
Pro tips

Web-spec details that bite later

Idempotency saves retries

POST/PUT/DELETE should be safely retried. Use idempotency keys and return the same response on duplicate requests.

Match RFC 9110 status codes

Don’t invent codes. 422 for validation errors, 409 for conflicts, 429 for rate limits. Standard codes work with off-the-shelf clients.

Set <code>Cache-Control</code> deliberately

Default browser caching is conservative. Use max-age + stale-while-revalidate for hot endpoints.

Validate Open Graph in dev

OG tags break silently. Use a previewer like OG Generator + Facebook’s debugger before launch.

CORS is a server concern

The browser sends the preflight; the server decides. Wildcard origins disable credentials — be explicit.

MIME drives behaviour

Servers must send the right Content-Type. Browsers sniff but the spec says they shouldn’t — be explicit to avoid surprises.

Related tools.htaccess TesterNginx Rewrite.htpasswdCORSCache-ControlHSTS
Use Cases

When to write .htaccess

Shared hosting, legacy sites, quick redirects.

HTTPS enforcement

One rule redirects every HTTP request to TLS. Bundled from IANA registries at build time — no live network call, no rate limit, no leaked queries. The MIME, TLD, and status-code tables are baked in so the tool works offline once loaded.

spec-compliant

Canonical host

Pick www vs apex once for SEO sanity. Output is canonical per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs), so spec-compliant parsers accept it as-is. Cross-browser and cross-library behaviour stays consistent.

offline

Page renames

301 old URLs to preserve link equity. Pairs with the curl-to-fetch converter for end-to-end test stubs — copy the curl from DevTools, paste, get an idiomatic fetch() body. Drop into Playwright/Vitest fixtures without manual translation.

IANA-backed

Sensitive files

Hide .env, .git, .htpasswd from the public. Catches common pitfalls (uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8) before they bite production. Validation flags rather than auto-corrects so you stay in control.

RFC-aligned

Trailing slash

Normalise slash policy for clean analytics. Validation runs as you type — copy only when the output is shaped correctly. The output drops directly into nginx, Apache, or CDN configs without re-formatting or re-quoting.

production-grade

Shared hosting

.htaccess is the only config you can write on cPanel hosts. Same input plus same options always produces identical canonical output, so the tool is safe to embed in CI scripts that diff against expected configs.

curl-ready
FAQ

Frequently asked questions

.htaccess applies per directory and reloads instantly; httpd.conf is global and faster but needs a restart. Use httpd.conf when you control the server.
302 indicates a temporary redirect — Google won't transfer ranking to the new URL. Use 301 for permanent moves.
Yes. Place HTTPS/www redirects before content rewrites so the user lands on the canonical host first.
Each request re-parses .htaccess up the directory tree. Long rule lists or many sub-directories add up — consolidate or move to httpd.conf.
No — rules are composed locally in your browser.
Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

Sent straight to the maintainers · no account needed
47 in queue·8 shipped this month
Request queued. Thanks!