Apache .htaccess Generator

About the Apache .htaccess Generator

An .htaccess file lets you change how the Apache web server handles your site without touching the main server configuration — the usual way on shared hosting. This generator writes one for Apache HTTP Server 2.4 from the options you pick: HTTPS and www/non-www redirects in a single hop, a bulk list of 301 redirects pasted from a spreadsheet, a single-page-app fallback, custom error pages, browser caching (mod_expires), gzip and Brotli compression, CORS headers, hotlink protection, IP blocking or allow-listing, a maintenance mode and common security headers.

Every section of the file is commented, and the page lists the Apache modules each one needs and the AllowOverride permission the server must grant — the two things behind most “500 Internal Server Error” messages after uploading an .htaccess. The generated rules are tested against Apache HTTP Server 2.4. Nothing you type leaves your browser.

Common uses

• Moving a site to HTTPS and settling on one address (with or without www) for search engines.
• Redirecting the old URLs of a redesigned or migrated site with 301s, straight to the final address.
• Hosting a React, Vue, Angular or Svelte app on shared Apache hosting without 404s on reload.
• Speeding up a static site with browser caching and compression.
• Allowing a web font or API file to be used from another domain (CORS), or stopping other sites from embedding your images.
• Taking a site offline for maintenance with a proper 503 while you can still reach it from your own IP address.

Why an .htaccess file causes “500 Internal Server Error”

Apache reads .htaccess on every request, and refuses the whole request when a line is wrong. The two usual causes:

• A module is not loaded. The error log says Invalid command 'Header', perhaps misspelled or defined by a module not included in the server configuration — ask the host to enable mod_headers, or remove that section. Caching and compression are wrapped in <IfModule> and are simply skipped without their module; redirects, access rules and headers deliberately are not, so you notice instead of silently losing them.
• The directive is not allowed in .htaccess. The log says … not allowed here. Each directive belongs to an AllowOverride category: rewrite rules, headers, error pages and compression need FileInfo, caching and the SPA fallback need Indexes, IP rules need AuthConfig, and Options -Indexes needs Options. The page lists exactly which ones your file needs; on shared hosting most are usually allowed.

mod_rewrite in .htaccess also needs at least one of the options FollowSymLinks or SymLinksIfOwnerMatch enabled for the folder (Apache 2.4 enables FollowSymLinks by default). Directive syntax, contexts and override categories here follow the Apache HTTP Server 2.4 documentation.

How the redirects are written

All redirects use mod_rewrite, so Apache tries them in the order they appear in the file. The list comes first and points each old URL straight at the final https:// address on your domain; the canonical-host and HTTPS rules follow. Each old URL is matched exactly (^/?old-page\.html$ works both in .htaccess and in the server configuration), and Apache compares it after decoding, so /caf%C3%A9 matches a request for /café. An old URL with a query string is matched on that exact query string, which is then dropped (QSD) unless the new URL brings its own. New URLs are written literally: mod_rewrite would read %2 in /new%20page or $1 as back-references, so %, $ and \ get a backslash (/new\%20page) and the NE flag keeps percent-encoding as it is. For trailing-slash variants, folder moves with wildcards, Nginx or IIS rules, and chain and loop checks, use the 301 redirect generator.

Caching and compression

mod_expires sends both Expires and Cache-Control: max-age for each media type. HTML is set to revalidate every time, so visitors always see new pages; CSS, JavaScript and images can be cached for longer. Use a year only for files whose names change when their content changes (fingerprinted builds); otherwise a visitor may keep an old stylesheet for a year. Compression covers text formats only — JPEG, PNG, WebP, WOFF2, MP4 and ZIP are already compressed. The Apache documentation warns that compressed responses over TLS can be open to the BREACH attack when a page mixes secrets with text an attacker can influence; static sites are not affected.

Behind Cloudflare, a load balancer or another proxy

When HTTPS ends at a proxy, Apache receives plain HTTP and %{HTTPS} is never “on”, so a normal HTTPS rule would redirect forever. Tick TLS ends at a proxy or CDN to also check the X-Forwarded-Proto header the proxy sends — but only if visitors cannot reach Apache directly, because anyone can send that header. For the same reason, IP rules see the proxy’s address unless the server uses mod_remoteip to restore the visitor’s address.

Limitations

• Written for Apache HTTP Server 2.4. Apache 2.2 used different access-control directives (Order/Allow/Deny), and Nginx, IIS and Caddy do not read .htaccess files at all.
• Rules in .htaccess are slower than the same rules in the server configuration, because Apache re-reads the file on every request. If you control the server, put them in the <VirtualHost> instead.
• The generator does not merge with an existing .htaccess: if your CMS (WordPress, for example) has its own block, paste these sections above it and keep its block intact.
• Password protection is not included; create the password file line with the bcrypt generator and add AuthType Basic yourself.

Privacy

Everything happens in your browser. What you enter or open here is not uploaded or stored by MySmartCoPilot.