Apache .htaccess Generator creates .htaccess configuration snippets for common tasks: URL redirects (301/302), URL rewriting (mod_rewrite), password protection (Basic Auth), custom error pages, HTTPS enforcement, CORS headers, caching rules, and directory listing control. Select the rules you need, fill in the parameters, and copy the generated directives.
.htaccess (hypertext access) is a per-directory configuration file for Apache web server. Rules in .htaccess apply to the directory it's in and all subdirectories (unless overridden). Each rule uses Apache directives: Redirect/RedirectMatch (URL redirects), RewriteRule/RewriteCond (mod_rewrite for URL rewriting), AuthType/AuthUserFile (password protection), Header (response headers), ExpiresActive (cache control), Options (directory listing, symlinks, CGI).
.htaccess performance note: Apache reads .htaccess files on every request (unlike server-side config in httpd.conf which is read once on startup). For high-traffic sites, move rules to httpd.conf (AllowOverride directive must be set). .htaccess cannot contain server-level directives like Listen or ServerName. Nginx does not support .htaccess — Nginx configuration lives in /etc/nginx/sites-available/ and is not per-directory.
Redirect HTTP to HTTPS
Result: RewriteEngine On\nRewriteCond %{HTTPS} off\nRewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
Custom 404 page
Result: ErrorDocument 404 /404.html\nErrorDocument 500 /500.html
Prevent directory listing
Result: Options -Indexes
How do I redirect a specific page in .htaccess?
For simple redirects: Redirect 301 /old-page.html https://example.com/new-page (301 is permanent, 302 is temporary). For pattern-based redirects using regex: RedirectMatch 301 ^/old-path/(.*) https://example.com/new-path/$1 — the $1 captures the matched group. For all 404s to a maintenance page: Redirect 302 / /maintenance.html (or use ErrorDocument). For domain change (old-site.com → new-site.com): RewriteEngine On / RewriteRule ^(.*) https://new-site.com/$1 [R=301,L].
How does mod_rewrite work in .htaccess?
mod_rewrite transforms URLs using RewriteRule (the pattern and target) and optionally RewriteCond (conditions that must be true). RewriteRule syntax: RewriteRule pattern substitution [flags]. Flags: L (last rule, stop processing), R=301 (redirect), NC (case-insensitive), QSA (append query string), P (proxy). Conditions: RewriteCond %{variable} pattern. Common variables: %{HTTP_HOST}, %{HTTPS}, %{REQUEST_URI}, %{QUERY_STRING}, %{REQUEST_FILENAME}. Regex: (.) is a group, .* matches anything, ^ anchors to start, $ to end, [L,R=301] is the flags list.
How do I password-protect a directory with .htaccess?
In .htaccess: AuthType Basic / AuthName 'Restricted Area' / AuthUserFile /path/to/.htpasswd / Require valid-user. Create the .htpasswd file: htpasswd -c /path/to/.htpasswd username (prompts for password). For additional users: htpasswd /path/to/.htpasswd username2. The /path/to/.htpasswd must be outside the web root to prevent direct access. For specific files: <Files secret.pdf> / AuthType Basic / ... / </Files>. Note: Basic Auth sends credentials in base64 (not encrypted) — always use over HTTPS.
What is AllowOverride and how does it affect .htaccess?
AllowOverride controls which .htaccess directives are allowed. AllowOverride None: .htaccess files are completely ignored (best for performance). AllowOverride All: all directives are allowed (common for shared hosting). AllowOverride FileInfo: only file type and mod_rewrite rules. AllowOverride AuthConfig: only authentication directives. AllowOverride Limit: only access control (Allow, Deny). Set in Apache's main httpd.conf or VirtualHost config. If your .htaccess rules aren't working, check that AllowOverride is not set to None and that mod_rewrite is loaded (LoadModule rewrite_module).
How do I set cache headers in .htaccess?
Method 1 (mod_expires): ExpiresActive On / ExpiresDefault 'access plus 1 month' / ExpiresByType image/jpeg 'access plus 1 year' / ExpiresByType text/css 'access plus 1 week'. Method 2 (mod_headers): <FilesMatch '\.(jpg|jpeg|png|gif|webp)$'> / Header set Cache-Control 'max-age=31536000, public' / </FilesMatch>. For no-cache on HTML: Header set Cache-Control 'no-cache, no-store, must-revalidate'. Note: long cache times require cache-busting in filenames (style.v2.css) or content-hash filenames (style.abc123.css) when updating files.