By · Updated

.htaccess Generator

Apache .htaccess Rules for Force HTTPS, Caching, Security Headers and SPA Fallback

No ratings yet

OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.

How the .htaccess Generator works

This htaccess generator writes the common .htaccess blocks correctly. Most .htaccess files are the same dozen blocks copied from half-remembered forum posts. Choose which behaviours you want — HTTPS, a canonical host, trailing slashes, compression, caching, security headers, error pages — and get a file built from current Apache 2.4 syntax with each module-dependent block wrapped in IfModule, so a missing module never takes the site down with a 500.

Htaccess generator: the common blocks

.htaccess is Apache's per-directory configuration file. Shared hosts and many managed servers do not let you edit the main configuration, so this file is where redirects, caching and headers live. It is powerful and unforgiving: a single typo returns a 500 error for every page. Generating it from tested fragments avoids most of that risk.

Rewrites. Force HTTPS, www handling, trailing slash rules, extensionless .html and the single-page-app fallback all use mod_rewrite and are combined into one RewriteEngine On block in the right order: scheme and host redirects first so a visitor gets one redirect rather than a chain, then path normalisation, then internal rewrites that do not change the URL. The HTTPS check uses %{HTTPS} !=on; if your host terminates TLS at a load balancer you may need to test %{HTTP:X-Forwarded-Proto} instead, which is a one-line edit. The www rules redirect to https:// — if you are not forcing HTTPS, change the scheme in the target.

Extensionless URLs and SPAs. The .html rule lets /about serve about.html without a redirect, which is a common choice for static sites. The SPA fallback sends every request that is not a real file or directory to index.html so client-side routers handle deep links. Do not turn both on unless you understand the interaction: the .html rule runs first and wins when a matching file exists.

Directory listings and file protection. Options -Indexes stops Apache from showing a file list for directories without an index. The file-protection block returns 403 for dotfiles such as .env and .git, plus backups, SQL dumps, logs and editor swap files that end up on servers by accident, and returns 404 for anything under .git so the directory's existence is not confirmed.

Error pages. ErrorDocument takes a path relative to the document root. Make the 404 page a real file with a normal layout and useful links; keep it self-contained so it also works when whatever caused the 404 has broken other assets.

Compression and caching. The mod_deflate block compresses text-based content types — HTML, CSS, JavaScript, JSON, XML and SVG — and leaves already-compressed images alone. Caching uses mod_expires. Moderate gives assets a month and HTML an hour; Aggressive gives assets a year and HTML no caching, which is correct when your build pipeline puts a content hash in asset file names. Without hashed file names, aggressive caching means visitors keep stale CSS after a deploy.

Headers. The security set covers X-Content-Type-Options, X-Frame-Options, Referrer-Policy and a restrictive Permissions-Policy, and adds Strict-Transport-Security only when Force HTTPS is also on, because HSTS on a site that still serves HTTP will lock visitors out. A Content-Security-Policy is deliberately not included; it depends entirely on your page and the CSP Builder on this site writes it. Removing Server and X-Powered-By hides version numbers from casual scanners. The font CORS rule lets a CDN or subdomain serve web fonts to your pages, which browsers otherwise block.

Testing. Upload, then load a page over http://, with and without www, a deep link, a missing page and a URL ending in .env. The stats panel lists which modules the file relies on; on a host that lacks one, that block is silently skipped rather than crashing, so verify each behaviour actually happens.

FAQ

Why is every block wrapped in IfModule?

Because an unknown directive in .htaccess returns a 500 error for the whole site. Wrapping mod_rewrite, mod_headers, mod_deflate and mod_expires directives in IfModule makes them no-ops when the module is absent. The trade-off is that a missing module fails silently, so test each behaviour after uploading.

My site is behind a proxy and Force HTTPS loops forever. Why?

The proxy terminates TLS and talks to Apache over plain HTTP, so %{HTTPS} is never on. Replace the condition with RewriteCond %{HTTP:X-Forwarded-Proto} !https, which checks the header the proxy adds. Cloudflare, load balancers and many managed hosts behave this way.

Should I use Aggressive caching?

Only if your asset file names change when their content changes, such as app.3f9c2a.js. Then a year-long cache is safe and fast. If your files keep the same names between deploys, choose Moderate, or visitors will see old styles and scripts until the cache expires.

Where do my individual redirects go?

Use the Redirect Generator on this site for old -> new URL mappings; it writes Apache RedirectMatch and RewriteRule lines you can paste below the blocks this tool generates. Keep them after the HTTPS and www rules so each visitor gets a single redirect.

Does this work on Nginx or LiteSpeed?

Nginx does not read .htaccess at all; its equivalent lives in the server block. LiteSpeed and OpenLiteSpeed read .htaccess and support the rewrite, header, expires and deflate directives used here, so the output works there with no changes.

See also: all Dev Utilities tools, Formatters & Validators, Data & Encoding, Security & Identifiers, SEO, Accessibility, AI.

Related tools

Redirect Generator

Turn an old-to-new URL list into 301 rules for Apache, Nginx, Netlify and Vercel.

HTTP Header Inspector

Parse pasted HTTP headers, explain each one and audit security.

CSP Builder

Build a Content-Security-Policy header from per-directive source lists.

Robots.txt Checker

Check a robots.txt file line by line before you deploy it.

Canonical URL Generator

Normalise URLs to their canonical form and generate rel=canonical tags.