Free. Generates Apache-compatible .htaccess output.

Free .htaccess Generator

Build a complete .htaccess file for Apache web servers — redirects, force HTTPS, IP blocking, password protection, custom headers, and more — without memorizing the syntax. Validates inputs, copies to clipboard, downloads as a file. Built by Datastrive, a Chicago managed IT and web hosting provider.

  • 8 rule categories
  • Live preview & download
  • Input validation

Redirect all HTTP traffic to HTTPS. Most modern hosting requires this for SEO and security — browsers flag HTTP-only sites as “Not secure.”

What this does: uses RewriteEngine with the %{HTTPS} condition to detect HTTP requests and 301-redirect them to the HTTPS version of the same URL. The optional www rule normalizes your canonical hostname.

Redirect old URLs to new ones. Use this when restructuring a site, moving pages, or consolidating URLs to preserve SEO.

301 vs 302: Use 301 (permanent) for SEO-relevant moves — Google passes link equity. Use 302 (temporary) only for short-term campaigns or testing. Source path should start with / (e.g., /old-page). Destination can be a path or full URL.

Block specific IPs or ranges from accessing your site. Useful for blocking abusive crawlers, brute-force attempts, or known bad actors.

Formats accepted: single IPv4 like 192.0.2.1, IPv4 with CIDR like 192.0.2.0/24, IPv4 octet prefix like 192.0.2. Uses Apache 2.4 syntax (Require not ip). For older Apache 2.2, edit the output to use Order/Allow/Deny.

Protect a directory with HTTP Basic Auth. Browsers will prompt for a username and password before serving any file.

Add HTTP response headers to harden your site against common attacks. Modern browsers honor these headers to limit what attackers can do.

HSTS warning: once you enable HSTS, browsers will refuse to load your site over HTTP for the duration of max-age. If your SSL breaks during that period, the site is unreachable. Enable HSTS only after confirming HTTPS is rock-solid.

Control whether Apache shows a directory’s contents when there’s no index file. Default behavior varies by host — some show the file list (privacy risk), some don’t.

Replace Apache’s default error pages with your own. Improves user experience and brand consistency when something goes wrong.

Common codes: 404 (not found), 403 (forbidden), 500 (server error), 503 (unavailable). Path must start with / and the file must exist (e.g., /404.html).

Block direct access to specific files or filename patterns. Useful for protecting .env, wp-config.php, .git directories, and other sensitive files.

Custom patterns

Generated .htaccess
Configure rules in the tabs above to generate your .htaccess file.

Working with .htaccess safely

The .htaccess file is powerful and unforgiving — one syntax error can take an entire site offline with a 500 error. The fixes below avoid the most common ways to make a Saturday-morning emergency.

  1. Always back up the existing file before changes Your hosting probably already has an .htaccess with rules from WordPress, your hosting provider, or prior admins. Download it first. If something breaks, you can restore in seconds. The 30 seconds spent on backup has saved more sites than any other piece of advice on this page.
  2. Test changes one rule type at a time Adding redirects, security headers, and IP blocking all at once means if something breaks you don’t know which rule did it. Add force-HTTPS first, test that the site loads. Then add headers. Test again. The slower path is dramatically faster than debugging seven things simultaneously.
  3. Order matters — HTTPS redirect before everything else Apache reads .htaccess top to bottom. Force-HTTPS rules need to fire before WordPress’s rewrite block, before any custom redirects, and before authentication. The generator above puts rules in the correct order automatically — if you’re hand-editing, keep HTTPS at the top.
  4. Don’t combine .htaccess with conflicting hosting panel settings cPanel, WHM, Plesk, and various managed-hosting panels often write redirects, force-HTTPS, and IP blocks at the server level. If you also do them in .htaccess, you can get redirect loops or double-401s. Pick one place — usually the panel for hosting-managed sites, .htaccess for VPS / dedicated.
  5. Be careful with RewriteRule and WordPress permalinks WordPress maintains its own RewriteRule block (between # BEGIN WordPress and # END WordPress). Don’t edit inside that block — WP will rewrite it. Add your custom rules before the WordPress block. This generator outputs rules with the correct ordering for that pattern.
  6. Modern Apache 2.4 syntax differs from 2.2 This generator uses Apache 2.4 syntax (Require ip, Require not ip) which has been standard since 2012. If your host is still on Apache 2.2 (rare in 2026 but exists), you’ll need the older Order Allow,Deny / Allow from / Deny from form. Most managed hosting tells you the Apache version in their docs.

Frequently asked questions

What’s an .htaccess file?

An .htaccess file is a configuration file for the Apache web server. When placed in a directory, Apache reads it on every request and applies its rules — redirects, access controls, header modifications, URL rewriting, and more. It’s named .htaccess because the leading dot makes it hidden on Unix systems.

The file is per-directory: a rule in /public_html/.htaccess applies to that directory and all subdirectories. A rule in /public_html/admin/.htaccess applies only to /admin/ and below, and overrides any conflicting rule in the parent.

Where do I put the .htaccess file?

For most sites, place it in your web root — the same directory as index.html or index.php. Common paths: /public_html/.htaccess, /var/www/html/.htaccess, or whatever your hosting calls the document root.

Upload it via FTP, SFTP, your hosting file manager, or copy-paste through cPanel’s file editor. The filename must be exactly .htaccess with the leading dot — some operating systems hide files starting with dots, so make sure your file manager is showing them.

Does .htaccess work on Nginx or Microsoft IIS?

No. .htaccess is Apache-specific. Nginx uses nginx.conf with a different syntax. IIS uses web.config with XML format. If your hosting runs Nginx, this generator’s output won’t work — you’d need an Nginx config generator instead.

How to tell what your host runs: check the hosting plan documentation, or look at HTTP response headers (Server: Apache vs Server: nginx). Most shared hosting is Apache; most modern VPS deployments are Nginx; managed WordPress hosts vary.

I added rules and now I get a 500 error. What happened?

A 500 Internal Server Error after editing .htaccess almost always means a syntax error or an unsupported directive. Common causes: a missing line break, a typo in a directive name, a directive that requires a module not enabled on your host (like mod_rewrite), or conflicting rules.

Quick recovery: rename your file to .htaccess.broken via FTP. The site will come back up. Then check the rules one at a time, or check your server’s error log (usually /logs/error_log in shared hosting) for the specific error message.

How is this different from .htpasswd?

They work together for password protection. .htaccess tells Apache “require authentication for this directory, and look for credentials in /path/to/.htpasswd.” The .htpasswd file contains the actual usernames and password hashes.

This generator builds the .htaccess side. You generate the .htpasswd file separately using the htpasswd command-line tool: htpasswd -c /path/to/.htpasswd username. Many hosting control panels have a “Password Protect Directory” feature that handles both files for you — check there first if you’re on managed hosting.

Can .htaccess slow down my site?

Slightly. Apache reads .htaccess on every request, and on every directory in the path leading to the requested file. For a request to /blog/posts/2024/article.html, Apache reads .htaccess in the root, in /blog, in /blog/posts, and in /blog/posts/2024 (if those files exist).

The performance impact is usually negligible for normal traffic but real for very high-traffic sites. The “best practice” workaround is to put rules in the main Apache config (httpd.conf or apache2.conf) and disable .htaccess processing entirely — but this requires server-level access most shared hosts don’t give. For typical small business sites, just use .htaccess and don’t worry about it.

Need someone to do it for you?

Datastrive manages WordPress sites, hosting infrastructure, and security configurations for businesses across the Chicago area. If .htaccess editing isn’t a fight you want to pick on a Friday afternoon, that’s what we’re for.

Talk to Datastrive →