.htaccess Generator
Generate an Apache .htaccess file with HTTPS redirects, www rules, caching headers, and custom error pages.
Did this tool work for you?
How to use this calculator
- 1
Select your HTTPS and www preferences and enter your domain name.
- 2
Toggle browser caching and Gzip compression on or off.
- 3
Choose whether to prevent image hotlinking and disable directory listing.
- 4
Select a PHP version hint if needed.
- 5
Copy or download the .htaccess file and upload it to your website's root directory.
Frequently asked questions
What happens if I leave the domain box empty?
The generator writes example.com into the www and hotlinking rules. There is no warning, so replace it before using the file. If you paste a full address such as https://www.example.co.uk/path, the tool reduces it to example.co.uk, because the www rules need the bare domain.
Can I get a redirect loop from the HTTPS rule?
Yes, in one common setup. The rule redirects whenever Apache itself sees a plain-HTTP request (RewriteCond %{HTTPS} off). If a CDN or load balancer ends the secure connection and talks to your server over HTTP, every request looks insecure to Apache and the browser loops. In that case the check has to use the forwarded-protocol header your proxy sends, which this generator does not produce.
Why do some visitors get two redirects?
Because HTTPS and www are separate rules. A request for http://www.example.com is first sent to https://www.example.com and then, with the non-www option, on to https://example.com. It works and both are permanent (301) redirects, but each extra hop costs a round trip. If you want a single hop, combine the two conditions by hand.
Will "Force www" redirect my other subdomains?
No. The rule applies only when the requested host is exactly your bare domain, so blog.example.com and api.example.com are left alone.
How does the hotlink protection decide who is blocked?
Requests for jpg, jpeg, png, gif, svg and webp files with a referring page that is not your domain get a 403 response. Requests with an empty referrer, such as direct visits, are allowed. Your own www and non-www addresses are allowed, but other subdomains such as cdn.example.com are not, and because the pattern has no end anchor, a lookalike host that begins with your domain name would pass. It is a deterrent, not security.
What exactly does the caching section set?
Expiry times through mod_expires: one year for jpg, jpeg, png, gif, webp and svg images, one month for CSS and application/javascript, and one day for HTML. Other file types, including fonts and files served with other MIME types, get no expiry from this block. A year-long cache on images means that replacing a file requires a new file name.
What is in the security headers block, and can I turn it off?
It is always included: X-Content-Type-Options nosniff, X-Frame-Options SAMEORIGIN, X-XSS-Protection "1; mode=block" and Referrer-Policy strict-origin-when-cross-origin. There is no option to omit it, so delete the block by hand if it clashes with your own headers. X-XSS-Protection is a legacy header, and no modern policy relies on it, so removing that line is reasonable.
Will the PHP version line work on my host?
Possibly not. It writes AddHandler application/x-httpd-php82 (for 8.2), a handler name used by some shared hosts. Handler names are defined by the host, so on another setup the line may have no effect or may break PHP pages. Check your host’s documentation or use its control panel to pick PHP versions, and leave this option on None unless you know your host uses that name.
Does it work on Nginx?
No. Apache reads .htaccess files, and only when the server is configured to allow overrides. Nginx ignores them, so equivalent settings go in its server configuration. A syntax error or unavailable directive in .htaccess can cause a 500 error, so keep a backup of the file you replace.
Building an Apache .htaccess file from options
What each option writes
The generator assembles blocks of Apache directives in a fixed order, each wrapped in an IfModule check where a module is needed, so a missing module skips the block instead of crashing the server. Redirects use mod_rewrite, compression uses mod_deflate, caching uses mod_expires and headers use mod_headers. The table maps each option to what it produces.
| Option | Output |
|---|---|
| Force HTTPS | Rewrite to https:// when HTTPS is off, 301 |
| Force non-www / www | Host-matching rewrite to the chosen form, 301 |
| Browser caching | ExpiresByType: images 1 year, CSS and JS 1 month, HTML 1 day |
| Gzip compression | DEFLATE for HTML, text, CSS, JavaScript, JSON, XML and SVG |
| Hotlink prevention | 403 for image requests referred from other sites |
| Disable directory listing | Options -Indexes |
| Custom error pages | ErrorDocument for 400, 401, 403, 404 and 500 |
| PHP version hint | AddHandler application/x-httpd-phpNN .php |
Worked examples
With the defaults and the domain pasted as https://www.example.co.uk/path, the output uses example.co.uk. It starts with Options -Indexes, then rewrites to HTTPS and sends www.example.co.uk to https://example.co.uk/$1 using the pattern ^www\.example\.co\.uk$ with every dot escaped. Gzip, caching, five ErrorDocument lines and the security headers follow. Choosing Force www, HTTPS off, hotlinking on and PHP 8.2 with everything else off gives a condition ^example\.com$ redirecting to http://www.example.com/$1, the image rule with a 403, the line AddHandler application/x-httpd-php82 .php, and the security headers.
Redirect rules and canonical hosts
Serving the same site at http, https, www and non-www creates four addresses for each page. Redirecting all of them with a permanent 301 to one canonical form lets search engines and users settle on a single URL. The generator writes the HTTPS and www rules separately, so some requests take two hops. If you choose Force www while HTTPS is off, the target stays on http://, matching your choice, and only the exact bare domain is redirected, leaving other subdomains alone.
Before you upload
Replace the placeholder domain if you left it empty. Keep a copy of your current file, because a bad directive produces a 500 error for every visitor. Test the HTTPS rule after uploading: behind a CDN or proxy that terminates TLS it can loop. Remember that the PHP line depends on your host’s handler names and that the security headers are always included. Upload the file to the web root of an Apache server that permits overrides.
What it does not generate
There are no custom redirects from old URLs to new ones, no password protection, IP allow or deny rules, no Content-Security-Policy or HSTS header, and no caching rules for fonts. Nothing is validated against your server: the file is text assembled from your choices, and it cannot confirm which modules are enabled. Nginx, IIS and most Node-based hosts do not read .htaccess files, so the output is of no use there.
Learn more from an authoritative source:
MDN Web DocsJSON Formatter & Validator
Format, validate, and minify JSON — with clear error messages for invalid input.
Base64 Encoder / Decoder
Encode plain text to Base64 or decode Base64 strings back to readable text.
URL Encoder / Decoder
Encode special characters in URLs (percent-encoding) or decode percent-encoded URLs.
UUID Generator
Generate UUID v4 (random) identifiers — one or in bulk.
Unix Timestamp Converter
Convert Unix timestamps to human-readable dates and times, and vice versa.
JWT Decoder
Decode and inspect JWT (JSON Web Token) headers and payloads without verifying the signature.
Results are estimates for informational purposes only and do not constitute professional financial, medical, legal, or technical advice. Read full disclaimer →