htaccess Generator Tool Online

Last updated: Jul 12, 2026

Build a clean Apache .htaccess file in your browser for redirects, HTTPS, caching, compression, security headers, and common hardening rules. Designed for developers, SEO teams, and site owners managing Apache hosting.

Apache rule options

Apache only. Back up your current .htaccess file before uploading a new version.

Force HTTPS Enable GZIP and deflate compression Add browser caching expires headers Add basic security headers Block access to sensitive files

www redirect

Custom 301 redirects

Add custom error pages

Generated .htaccess

Refer a Client, Earn a Reward

Introduce a client who needs a website or help getting found. We handle the proposal, delivery and support directly with your client. One-off projects pay 10%, with a $100 minimum. Monthly retainers pay 10% each month for the first six months.

Refer a client

See 36 client websites

How the htaccess Generator Works

This generator builds Apache directives from practical, production-focused options:

Choose redirect behavior, force HTTPS and set your preferred www or non-www canonical host.
Add custom 301 redirects, enter old and new paths for moved pages, retired URLs, or SEO migrations.
Select performance rules, add compression and browser caching for common static assets.
Add hardening rules, include security headers and sensitive file protection for common Apache sites.
Copy and test, paste the complete block into .htaccess and validate it on staging before production.

Why Apache Rules Matter for SEO and Security

A well-written .htaccess file can fix canonical URL problems, protect sensitive files, and improve site performance. A bad one can create redirect loops, 500 errors, or crawl waste.

Canonical consistency, HTTPS and www redirects consolidate duplicate URL versions.
Preserved rankings, 301 redirects help search engines transfer signals from old URLs to new URLs.
Performance gains, compression and caching reduce transfer size and repeat-load delays.
Baseline protection, file blocks and security headers reduce exposure to common misconfigurations.

If you are changing URLs during a redesign, combine this with a technical SEO audit and a crawl map before launch. For modern static builds, our Astro framework guide explains when you may not need Apache at all.

Common .htaccess Rules and What They Do

Use this table to decide which rules belong in your Apache configuration.

Rule	What it does
Force HTTPS	Redirects HTTP visitors and crawlers to the secure HTTPS version.
www redirect	Chooses one canonical host and redirects the alternate version.
301 redirects	Moves old URLs permanently to new destinations.
GZIP or deflate	Compresses text assets before transfer to reduce bandwidth.
Expires headers	Tells browsers how long to cache static assets.
Security headers	Adds browser-level protections such as nosniff and frame blocking.
Sensitive file block	Prevents direct access to files like .env, composer.json, and backups.
Error pages	Routes 404 and 500 errors to custom user-friendly pages.

Important: This is for Apache .htaccess only, not Nginx. If your host uses Nginx or Vercel, redirects and headers belong in that platform's configuration instead.

Common .htaccess Directives Reference

These are the Apache directives behind the most common .htaccess rules. Copy them as a starting point, then adjust paths and domains for your site. Always validate on staging before deploying to production.

Directive	Purpose	Example
`RewriteEngine On`	Enables the mod_rewrite engine so RewriteRule and RewriteCond can run.	`RewriteEngine On`
`Redirect 301`	Permanently redirects one URL or path to another, passing ranking signals.	`Redirect 301 /old/ /new/`
Force HTTPS	Redirects HTTP requests to the secure HTTPS version of the URL.	`RewriteCond %{HTTPS} !=on` `RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]`
non-www to www	Forces the www host as the single canonical version.	`RewriteCond %{HTTP_HOST} !^www\. [NC]` `RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]`
www to non-www	Forces the bare domain as the single canonical version.	`RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]` `RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]`
Gzip (mod_deflate)	Compresses text-based responses to reduce transfer size.	`<IfModule mod_deflate.c>` `AddOutputFilterByType DEFLATE text/html text/css application/javascript` `</IfModule>`
Browser caching (mod_expires)	Sets how long browsers cache static assets.	`<IfModule mod_expires.c>` `ExpiresActive On` `ExpiresByType image/png "access plus 1 year"` `</IfModule>`
Custom error pages	Serves friendly pages for 404 and 500 errors instead of default Apache output.	`ErrorDocument 404 /404.html` `ErrorDocument 500 /500.html`

Redirect chains, mixed www rules, and missing HTTPS enforcement are some of the most common issues we uncover during a free website audit. If you are migrating URLs or hardening an Apache site, get a second set of eyes before launch.

Next steps

.htaccess Generator related tools and articles

Continue with the closest follow-up checks and guides based on this tool's topic, crawl intent, and optimization workflow.

Technical SEO Audit Guide

Security Headers Checker

Website Speed Optimization

Benefits of Static Websites: Speed, Security, and SEO in 2026

WordPress vs Astro: Which Is Better for Business in 2026?

PHP 8.2 End of Life (Dec 31, 2026): WordPress Upgrade Plan

htaccess Generator: FAQ

Which Apache directives can this generator create?

It can generate rules for HTTPS redirects, www or non-www canonicalization, GZIP compression, browser caching, a small set of security headers, sensitive-file blocking, custom 301 redirects, and custom 404 or 500 error documents. Only enabled sections appear in the output.

Why is no www redirect generated when I select a www option?

The www and non-www rules require a domain in the Domain field. Enter only the hostname, such as example.com. The generator removes a leading protocol and www before building the canonical redirect rule.

How should I enter custom 301 redirects?

Enter an old path and a destination path or URL for each row. The generator creates Apache Redirect 301 directives, so use this section for straightforward path redirects. Query-string matching, regex conditions, and complex rewrite chains need hand-written mod_rewrite rules.

Can the Force HTTPS rule loop behind a CDN or reverse proxy?

Yes. The generated rule checks Apache's HTTPS value directly. If TLS ends at a proxy and Apache sees the request as HTTP, the rule can loop unless your proxy and server pass and interpret the forwarded protocol correctly. Test the rule in staging first.

What do the IfModule blocks mean?

Compression, caching, and header sections are wrapped in IfModule checks. Apache skips a section when the corresponding module is unavailable, so a successful page load does not prove that mod_deflate, mod_expires, or mod_headers is active. Confirm modules and response headers on the server.

Does the security section create a complete security policy?

No. It adds X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy, plus an optional sensitive-file block. It does not generate a Content-Security-Policy, HSTS, application authentication, or server hardening.

How can I deploy the generated file safely?

Back up the current .htaccess file, apply one section at a time in staging, then test important URLs, forms, assets, redirects, and error pages. If Apache returns a 500 error, restore the backup and inspect the server error log for an unsupported directive or module.

Is my domain or redirect data sent to Web Aloha?

No. The generator builds and copies the configuration in your browser. The domain, paths, and generated .htaccess text are not submitted to a Web Aloha endpoint by this tool.