Htaccess Generator
Generate an Apache .htaccess file: force HTTPS, canonicalize www vs non-www, add 301 redirects, custom error pages, and browser cache headers. Every module-specific rule is IfModule-guarded so a missing module can't 500 your site.
Force HTTPS
Redirect any plain HTTP request to HTTPS.
WWW canonicalization
Pick one canonical host so search engines don't split ranking between both.
Redirects
301 redirects from an old path to a new path or URL.
Custom error pages
Point specific HTTP error codes at your own page.
Cache headers
How long browsers should cache each asset type before rechecking.
<IfModule mod_rewrite.c>
RewriteEngine On
# Force HTTPS
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>
An .htaccess file lets Apache apply rules — redirects, caching, custom error pages, HTTPS enforcement — per-directory, without touching the server's main config. That convenience is also the risk: a single malformed line, or a directive from a module your host hasn't enabled, can take down every page under that folder with a 500 error instead of the specific rule failing gracefully.
This generator only ever emits rules built from fixed, known-safe templates — nothing is derived from freeform regex you write yourself. Every module-specific block (mod_rewrite for redirects, mod_expires for cache headers) is wrapped in an IfModule guard, so if a directive's module isn't enabled on your host, Apache just skips that block instead of erroring the whole site. Toggle what you need below and copy the result straight into your .htaccess file.
How to use the htaccess generator
- 1Turn on Force HTTPS and pick a www preference if you want either — both are self-contained rules and don't depend on knowing your actual domain name.
- 2Add any 301 redirects for pages that moved, and enable custom error pages for the codes you want to handle yourself (404 is the common one).
- 3Enable cache headers for static asset types you're serving — images and fonts benefit the most, since they rarely change.
- 4Copy the generated file and paste it into the .htaccess file in your site's root directory (create one if it doesn't exist yet — it's a plain text file, dot-prefixed).
What each rule actually does
| Directive | What it does | Use it when |
|---|---|---|
| RewriteCond %{HTTPS} off | Redirects any plain HTTP request to HTTPS | Your SSL/TLS certificate is installed and every visitor should land on the encrypted version |
| RewriteCond %{HTTP_HOST} ^www\. | Redirects www.example.com to example.com (or the reverse) | You've picked one canonical host so search engines don't split ranking signals between both |
| Redirect 301 /old /new | Permanently redirects one URL to another | A page moved or was renamed and you don't want visitors or crawlers hitting a 404 |
| ErrorDocument 404 /404.html | Serves your own page instead of Apache's default error page | You want a branded, on-site 404/500 page instead of the plain server default |
| ExpiresByType image/png "access plus 1 year" | Tells browsers to reuse a cached copy instead of re-requesting the file | Static assets that rarely change — images, fonts, CSS/JS — to speed up repeat visits |
Frequently asked questions
Can this break my live site if something's wrong?+
Every rule here comes from a fixed template, not freeform text you write, so the syntax itself is always valid Apache. The two things that can still go wrong on any .htaccess, generated or hand-written, are a module not being enabled on your host and a redirect loop from conflicting rules elsewhere in the file — which is exactly why every module-specific block here is wrapped in <IfModule>, and why the HTTPS and www rules are kept as separate, independent rules rather than one clever combined one.
What's the difference between a 301 and a 302 redirect?+
301 means "permanently moved" — browsers and search engines cache it and update their records to point at the new URL directly. 302 means "temporarily moved" — it isn't cached the same way, and search engines keep the original URL indexed. Use 301 (what this tool generates) when a page has actually moved for good; a temporary redirect is a different, situational tool.
Why is every rule wrapped in <IfModule>?+
mod_rewrite (used for HTTPS/www redirects) and mod_expires (used for cache headers) aren't guaranteed to be enabled on every Apache host. Without an IfModule guard, a directive from a disabled module causes a server error for every request under that .htaccess — not just a warning. With the guard, Apache simply skips the block if the module isn't there, and everything else in the file still works.
Why does the redirect target %{HTTP_HOST} instead of my actual domain name?+
Using the request's own host and path dynamically means the rule works correctly no matter what domain or subdomain it's running on — including staging environments, additional domains pointed at the same site, or a domain change down the line. Hardcoding a specific domain into a redirect rule is a common source of broken redirects when a site later moves or adds a second domain.
I enabled cache headers but my browser still isn't caching the file — why?+
A few common causes: the host's Apache doesn't have mod_expires enabled (the IfModule guard means the rule is just silently skipped, not applied); a CDN or reverse proxy in front of the server is stripping or overriding the headers; or you're checking with dev tools open, which disables the browser cache by default in most browsers. Check the actual response headers with curl -I against the live file to see what's really being sent.
Where does the .htaccess file actually go?+
In the directory it should apply to — usually your site's document root (the folder containing index.html or index.php) for rules that should apply site-wide. Apache applies .htaccess files hierarchically, so one in a subdirectory only affects that subdirectory and the folders inside it. It's a plain text file literally named .htaccess (no filename before the dot).