Skip to main content
lab.golamrabbani.org

Apache .htaccess Generator

Generate an Apache .htaccess with redirects, gzip, caching, and security headers.

Written by Golam Rabbani, Founder & Lead Engineer

Pick the .htaccess rules you need: HTTPS redirect, www handling, gzip, long caching, security headers, hotlink protection, custom 301 redirects, and more. Each section is wrapped in the right <IfModule> guard so the file stays portable.

Required only for www handling, hotlink protection, etc.

Rules

Format: "/old-path /new-url" — one per line

How to use this apache .htaccess generator

  1. Enter your primary domain (required for www handling and hotlink protection).
  2. Tick the rule blocks you want — Force HTTPS, Force/Remove www, gzip, security headers, hotlink protection, and more.
  3. Add custom 301 redirects in "old-path new-url" form, one per line.
  4. Optionally paste a list of user-agents to block, one per line.
  5. Click Generate and Copy .htaccess, then place the file at the root of the directory you want to protect.

About this apache .htaccess generator

The Apache .htaccess generator turns a single form into a portable .htaccess file. Every block is wrapped in the appropriate `<IfModule mod_xxx.c>` guard so the file does not 500 your server if a module is not loaded — RewriteEngine rules go inside `mod_rewrite.c`, gzip inside `mod_deflate.c`, expires inside `mod_expires.c`, and security headers inside `mod_headers.c`.

Custom redirects use anchored RewriteRule statements with `[L,R=301]` for permanent redirects. The www handling rule normalises Hosts using `RewriteCond %{HTTP_HOST}` with NC (case-insensitive). User-agent blocks compile your bot list into a single `(BadBot|EvilCrawler|...)` regex with `[NC]` matching and a `[F]` (403) terminator.

As a worked example, ticking Force HTTPS, Force www, gzip, long-cache static assets, security headers, and adding `/old-page /new-page` as a custom redirect produces a file with: a `<IfModule mod_rewrite.c>` block that 301s HTTP→HTTPS, naked→www, and `/old-page` → `/new-page`; a `<IfModule mod_deflate.c>` block adding `DEFLATE` filters for text, JS, JSON, SVG; a `<IfModule mod_expires.c>` block setting `ExpiresByType image/png "access plus 1 year"` and similar; and a `<IfModule mod_headers.c>` block with `nosniff`, `SAMEORIGIN`, and Referrer-Policy. Generation runs entirely in your browser — nothing is uploaded.

FAQ

Where do I save the generated .htaccess file?
Put it at the root of the directory you want it to apply to — usually `/var/www/html/.htaccess` for the site root. Apache reads .htaccess on every request inside that directory tree, so the rules take effect immediately (no reload needed) as long as the parent vhost has `AllowOverride All` or the specific directives you use.
Why is every block wrapped in <IfModule>?
If a module like mod_rewrite is not loaded, an unguarded directive triggers a 500 Internal Server Error. The IfModule wrapper makes the file portable — it silently skips a block whose module is missing instead of breaking the whole site.
What is the difference between Force www and Remove www?
Force www 301-redirects the apex (`example.com`) to `www.example.com`; Remove www does the opposite. You should pick exactly one — both at the same time would cause an infinite redirect loop. The form blocks you from selecting both.
How does the hotlink protection rule work?
It checks the Referer header: if a request for an image (jpg, png, webp, etc.) comes from a referrer that is not your own domain, Apache returns 403 Forbidden. Empty referrers (direct hits, RSS readers) are allowed, which avoids breaking legitimate use cases.
Will this file send any data anywhere?
No — the generator runs in your browser. Your domain, redirect rules, and user-agent list are never uploaded, logged, or stored. Closing the tab discards the form.
Is this Apache .htaccess generator free to use?
Yes, it is completely free with no account, no signup, and no usage limits.