How to create an .htaccess file for Apache, free and private
An .htaccess generator writes the Apache rules for you so you do not have to remember the syntax. Here, tick the options you need under Basic Configuration, add rows for URL redirects, blocked IPs, blocked user agents and custom error pages, and the Generated .htaccess panel updates as you go. Then click Copy or Download and upload the file to your site.
It runs in your browser; nothing is uploaded (you can check the Network tab in DevTools). Mistakes that would make Apache answer with a 500 error are listed under Check before uploading.
The output is Apache 2.4 syntax, which LiteSpeed also reads. Nginx does not read .htaccess files. The generator does not create a .htpasswd password file and does not read an existing .htaccess, so merge the new rules into your current file by hand. After uploading, confirm the result with the HTTP header viewer, which shows the redirect chain and response headers of a public URL.
Table of Use: common jobs and the rules they write
| Job | Use | Rules written |
|---|---|---|
| Send all visitors to HTTPS | Force HTTPS | RewriteCond %{HTTPS} off then RewriteRule … [L,R=301] |
| One canonical address (HTTPS and www, or non-www) | Force HTTPS plus WWW Configuration | A single combined 301 redirect, so visitors are not bounced twice |
| Move a page | Add Redirect, 301 | Redirect 301 /old-page /new-page |
| Move a URL that has a query string | Add Redirect with /page.php?id=5 | A RewriteCond on QUERY_STRING and a RewriteRule … [R=301,L,NE] |
| Block an address or range | Add IP | Require not ip 203.0.113.7 inside a RequireAll block |
| Block a bot | Add Agent | RewriteCond %{HTTP_USER_AGENT} AhrefsBot [NC] then RewriteRule ^ - [F] |
| Show your own error page | Add Page, status 404 | ErrorDocument 404 /error-404.html |
| Compress text files | Enable GZIP Compression | AddOutputFilterByType DEFLATE … inside IfModule blocks |
| Cache images, fonts and scripts | Enable Browser Caching | ExpiresByType image/png "access plus 1 year" and similar lines |
| Stop other sites embedding your images | Enable Hotlink Protection | RewriteRule \.(jpe?g|png|gif|webp|avif|svg)$ - [NC,F] |
| Ask for a login | Enable Password Protection | AuthType Basic, AuthUserFile, Require valid-user |
| Add security headers | Security Headers | Header always set X-Content-Type-Options "nosniff" and similar lines |
Before you block an address, look it up with the IP address lookup; to see what a bot calls itself, paste its string into the user agent parser.
Features
- Every common rule on one screen. Force HTTPS, www or non-www, redirects, IP blocking, user-agent blocking, custom error pages, GZIP, browser caching, hotlink protection, password protection and four security headers.
- Check before uploading. The tool flags an invalid IP, a redirect that would loop, a path that does not start with /, an unusable .htpasswd path and similar mistakes, and it escapes user-agent text so a space cannot break the rule.
- Safer defaults. GZIP, caching and header rules sit inside IfModule blocks, so a missing Apache module is skipped instead of causing an error. Caching is 1 year for images and fonts, and 1 month for CSS, JavaScript and PDF.
- Blocking that combines correctly. Several user agents are joined with OR. With password protection and IP blocking both on, they share one RequireAll block, so a blocked address is refused even with the right password.
- Copy or Download. The download is named .htaccess, though Chrome may save it as htaccess because downloads cannot start with a dot.
- Private and free. No account, and nothing is stored: reloading resets every option.
Rules that rewrite URLs often need a second look at your crawl files, so update your sitemap and robots.txt afterwards.
How to use the .htaccess generator
- Under Basic Configuration, tick Force HTTPS, pick a WWW Configuration, and tick Enable GZIP Compression or Enable Browser Caching if you want them.
- To move pages, click Add Redirect and fill in the old path, the 301 or 302 type and the new path or URL. Use clean paths such as those from the slug generator.
- To block visitors, click Add IP or Add Agent. To show your own error page, click Add Page.
- Tick Enable Hotlink Protection, Enable Password Protection or any of the Security Headers you need, and fill in the fields that appear.
- Read the amber Check before uploading box, if it appears, and fix each item.
- Click Copy or Download. Back up your current .htaccess, upload the new file to your site’s root folder and make sure it is named exactly .htaccess.
- Open the site in a private window. After switching on HTTPS, check the certificate with the SSL certificate checker. If you see a 500 error, restore the backup.
Who can use it
- Site owners on shared hosting who have Apache and an .htaccess file but no access to the server configuration.
- WordPress and CMS users who need a redirect, a canonical host or a password on a folder without installing a plugin.
- Developers, SEO specialists and students drafting 301 redirects for a site move, or learning mod_rewrite from commented output, then testing hand-edited patterns in the regex tester.
- Webmasters moving DNS or hosts, who can confirm records with the DNS lookup tool before forcing www.
FAQs
How do I redirect HTTP to HTTPS with .htaccess?
Tick Force HTTPS. The generator writes RewriteEngine On, a condition that matches requests where HTTPS is off, and a rule that sends them to the same host and path over https:// with a 301. Your certificate must already work, or visitors will see warnings. Behind a proxy that talks to Apache over HTTP, it can loop.
How do I redirect one page to another with .htaccess?
Click Add Redirect, enter the old path starting with / (for example /old-page), choose 301 for a permanent move or 302 for a temporary one, and enter the new path or full URL. The tool writes a Redirect line. Apache also redirects everything below the old path, so the tool warns when the new address sits inside it.
How do I block an IP address in .htaccess?
Click Add IP and enter an address such as 203.0.113.7, a range such as 203.0.113.0/24, an IPv6 address or a partial address such as 10.1. The tool writes Require not ip lines inside a RequireAll block, which is Apache 2.4 syntax. An invalid entry is left out and listed under Check before uploading, because Apache would answer every request with a 500 error.
How do I block a bot by user agent in .htaccess?
Click Add Agent and type text from the bot’s User-Agent header, such as AhrefsBot. A request whose User-Agent contains that text, in any letter case, gets 403 Forbidden. Several entries are joined with OR. User agents are easy to fake, so this stops bots that announce themselves honestly, not determined scrapers.
How do I password protect a folder with .htaccess?
Tick Enable Password Protection, type a realm name for the login prompt and enter the absolute server path of your .htpasswd file. The tool writes AuthType Basic, AuthName, AuthUserFile and Require valid-user. It does not create the password file: make it on the server with the htpasswd command, ideally outside the public folder, and use this only over HTTPS.
Why do I get a 500 error after uploading .htaccess?
Apache answers every request with a 500 error when it cannot read a line: a typo, an unknown directive, a missing .htpasswd file or an override your host does not allow. This tool validates IPs, redirect paths and domains, and wraps GZIP, caching and header rules in IfModule blocks. If you still get a 500, restore your backup and check your host’s error log for the failing line.
Where do I upload the .htaccess file, and does it work on Nginx?
Back up any existing .htaccess, then upload the file to your site’s root folder, or the folder it should protect, named exactly .htaccess. Chrome saves the download as htaccess without the dot, so rename it on the server. It needs Apache 2.4 or LiteSpeed. Nginx ignores .htaccess files completely, so the rules must be rewritten as Nginx configuration.
Is my .htaccess configuration uploaded anywhere?
No. The file is built by JavaScript in your browser, so your domain, paths and IP addresses are never uploaded (you can check the Network tab in DevTools). Nothing is stored: reload the page and every option resets. It is free, with no account.