.htaccess Generator

Generate an .htaccess with HTTPS and www redirects, trailing slash rules, Laravel, WordPress or SPA front controllers, blocked dotfiles, caching and compression.

Free · No sign-up · Your inputs stay in your browser

Input

Generate an .htaccess file

HostTrailing slashFront controllerCustom 404 pageOptional, e.g. /404.html

Output

.htaccess

1,549 characters

Options -Indexes

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Block .env, .git and other dotfiles, but allow .well-known
    RewriteRule (^|/)\.(?!well-known/) - [F,L]

    # Force HTTPS
    RewriteCond %{HTTPS} off
    RewriteCond %{HTTP:X-Forwarded-Proto} !https
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    # www to the bare domain
    RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
    RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]

    # Remove trailing slashes (not from real directories)
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Laravel: pass the Authorization header through, then the front controller
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>

<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/webp "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType image/svg+xml "access plus 1 year"
    ExpiresByType font/woff2 "access plus 1 year"
    ExpiresByType text/css "access plus 1 year"
    ExpiresByType application/javascript "access plus 1 year"
    ExpiresByType text/html "access plus 0 seconds"
</IfModule>

<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/css text/xml application/javascript application/json application/xml image/svg+xml
</IfModule>

Redirects come before the front controller so each one is a single 301 rather than a chain. Long cache lifetimes are only safe for files whose names change when their content does (app.3f9a1c.js); HTML is sent with no cache. .htaccess is read on every request: on a server you control, the same rules in the vhost are faster.

Runs in this browser. Nothing you paste is sent to a server.

About this tool

Method, assumptions, practical next steps, and limits.

Order prevents chains

Each redirect costs a round trip, and two in a row (http://www to https://www to https://) waste one. Writing the HTTPS rule to target the final host, and putting all redirects before the front controller, keeps every redirect to a single 301. The RewriteRule flags reference explains L and R.

Block the dotfiles

A .env or .git directory inside the document root is served to anyone who asks for it, and scanners ask constantly. The rule here refuses every path segment starting with a dot except .well-known, which ACME certificate validation and security.txt need.

Frequently asked questions

Why is .htaccess slower than the server config?

Apache looks for and reads .htaccess in every directory of the path on every request. On a server you control, the same rules in the VirtualHost with AllowOverride None are faster.

Why does my HTTPS redirect loop behind a load balancer?

The load balancer terminates TLS and talks plain HTTP to Apache, so HTTPS is always off. The generated rule also checks X-Forwarded-Proto, which the balancer sets to https.

Is what I paste sent anywhere?

No. The tool runs entirely in your browser with JavaScript. Nothing you type or paste is sent to our server or stored.

.htaccess Generator

Generate an .htaccess file

.htaccess

Order prevents chains

Block the dotfiles

Frequently asked questions

Similar tools

CSS Clamp Generator

Link Extractor

Keyword Density Checker