.htaccess Generator
Generate Apache .htaccess rules for HTTPS, www, gzip, caching, and security.
Last updated: August 2026
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ https://%1/$1 [L,R=301]
<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/html text/css application/javascript application/json image/svg+xml
</IfModule>
<IfModule mod_expires.c>
ExpiresActive On
ExpiresByType image/jpg "access plus 1 year"
ExpiresByType image/png "access plus 1 year"
ExpiresByType text/css "access plus 1 month"
ExpiresByType application/javascript "access plus 1 month"
</IfModule>
<FilesMatch "^\.">
Require all denied
</FilesMatch>Was this tool helpful?
Apache rules without memorizing the syntax
An .htaccess file applies Apache configuration at the directory level: redirects, rewrites, compression, caching, and security tweaks, all without touching the main server config. A generator assembles the right directives for common goals so you avoid the fiddly mod_rewrite syntax that is easy to get subtly wrong.
The usual recipes
The frequent requests are forcing HTTPS, canonicalizing between the www and bare domain, enabling gzip through mod_deflate, setting far-future cache headers on static assets via mod_expires, and adding security headers. Each is a few lines, but the order and the rewrite conditions matter.
Example
RewriteEngine On
# Force HTTPS
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
# Cache static assets for a year
<IfModule mod_expires.c>
ExpiresActive On
ExpiresByType image/png "access plus 1 year"
</IfModule>The R=301 flag makes the HTTPS redirect permanent, and L stops further rules from running on that request.
Why 301s are a one-way door
A 301 is a permanent redirect, and browsers cache it aggressively. If you set up an HTTPS or domain redirect with a mistake, visitors can keep hitting the cached redirect even after you fix the file. Test with a 302 (temporary) first, then switch to 301 once the behavior is confirmed. Note that .htaccess only works where AllowOverridepermits it, and it adds a small per-request cost compared to main config.
FAQ
My redirect loops forever, why? Usually the HTTPS condition is wrong behind a proxy or load balancer, where Apache sees HTTP internally. Check X-Forwarded-Proto instead of %{HTTPS} in that setup.
Nothing happens when I edit the file, why? Either AllowOverride is set to None for that directory, or the required module (like mod_rewrite) is not enabled.