Htaccess Generator
This free htaccess generator builds a commented .htaccess file for Apache and LiteSpeed. Tick what you need, such as force HTTPS, www or non-www, 301 redirects, security headers, caching and blocked IPs, then upload the file to your site's root folder.
Your .htaccess
The download is named htaccess.txt because many computers hide files that start with a dot. Upload it to your site's root folder (public_html on most hosting) and rename it to .htaccess. Save a copy of your current file first.
Built in your browser. Nothing you enter is sent to us. Works on Apache 2.4 and LiteSpeed; nginx does not read .htaccess files.
Free, no signup.
What is an .htaccess file?
An .htaccess file is a plain text file that Apache web servers read on every request. It lets you change how a folder of your site behaves without touching the main server settings: redirect old pages, force HTTPS, add security headers, set caching rules or block visitors.
The rules apply to the folder the file sits in and every folder below it, so the copy in your site's root folder is the one that matters most. One wrong line in it can stop the whole site loading with a 500 error. That is why this generator checks every value you enter and leaves out anything Apache would not accept.
Where to put it and how to test it
Upload the file to the root folder of your site, usually public_html, and name it .htaccess, with the dot at the start and no extension. Many computers hide files that start with a dot, so the download is called htaccess.txt. Rename it after you upload it, in your file manager or FTP program.
Before you change anything, download a copy of the .htaccess you have now. If your site already has one, add the new rules at the top rather than replacing the lot. Then open your site in a private browser window and try a few pages, an old URL you redirected, and the http:// and www versions of your address. Our redirect checker shows every hop, so you can see each one ends where you expect.
Redirects without losing SEO
A 301 redirect tells browsers and search engines that a page has moved for good, and search engines pass the old page's ranking signals on to the new address. Redirect each old URL that has links or traffic to its closest new page, not everything to the home page.
Keep chains short: one hop from the old address to the final one is best. A plain Redirect line also moves everything below the old path, so /blog catches /blog/my-post too. If you need an exact match or a pattern, tick Regex and write the old path as a regular expression, such as ^/old-page.html$ for that one page only.
Security rules worth adding
Turn off directory listing so nobody can browse folders that have no index page. Block web access to files that should never be public: .env files with passwords, the .git folder, wp-config.php, database dumps, backups and logs. Automated scanners look for these first.
Security headers tell the browser to be stricter with your pages. nosniff stops it guessing file types, the framing rule (X-Frame-Options) stops other sites showing your pages inside theirs, and a referrer policy limits what other sites learn about your visitors. HSTS makes browsers use HTTPS only and they remember it for a year, so turn it on once HTTPS works on every page. Our security headers checker shows what your site sends today.
Apache, LiteSpeed and nginx
Apache reads .htaccess files, and so does LiteSpeed, a faster web server that understands the same rules. Most shared hosting with cPanel runs one of the two, so the file from this page works there as it is.
nginx does not read .htaccess files at all. On an nginx server the same ideas go into the server configuration, written in nginx's own syntax, and the server needs a reload. If you are not sure which server you have, the Server header in our HTTP header checker often tells you, or ask your host.
Frequently asked questions
Why does my site show a 500 error after uploading .htaccess?
Apache answers with a 500 Internal Server Error when it finds a line it does not understand or is not allowed to use. Put your old file back first, then add the new rules one block at a time to find the one your server rejects. A common cause is a host that does not allow the Options line; remove that block if so.
Does the order of rules in .htaccess matter?
Yes. Rewrite rules run from top to bottom and stop at the first one that redirects, and the first matching Redirect line wins. That is why this generator puts HTTPS before www, and why your own rules should go above the WordPress block.
I use WordPress. Where do these rules go?
Above the # BEGIN WordPress line. WordPress rewrites everything between # BEGIN WordPress and # END WordPress when you save your permalinks, so anything you put inside that block is lost. Leave the WordPress block as it is.
Why does Force HTTPS cause a redirect loop behind Cloudflare or a proxy?
With Cloudflare's Flexible SSL mode or a load balancer, the visitor talks HTTPS to the proxy, but the proxy talks plain HTTP to your server. A simple rule sees HTTP every time and keeps redirecting. The rule here also checks the X-Forwarded-Proto header the proxy sends, so it stops once the visitor is on HTTPS. Better still, put a certificate on your server and use Cloudflare's Full (strict) mode.
How do I undo a change to .htaccess?
Upload the copy you saved before, or delete the lines you added. Apache reads the file on every request, so the change takes effect straight away with no restart. HSTS is the exception: browsers that already saw it keep using HTTPS for up to a year.
Does this work on nginx?
No. nginx ignores .htaccess files. The same ideas apply, but the rules have to be written in nginx syntax in the server configuration.
Is anything I type sent to a server?
No. The file is built in your browser and nothing you enter is sent to us.
Dig deeper
Htpasswd Generator
Turns a username and password into a bcrypt or APR1-MD5 .htpasswd line, entirely in your browser.
Generate a lineRedirect Checker
Follows a URL hop by hop to its final page: status codes, timing, loops and long chains.
Trace redirectsSecurity Headers Checker
Grades a site's HTTP security headers from A+ to F, with ready-to-paste fixes for Apache and nginx.
Grade a site