Generators

.htaccess Generator

Toggle the rules you want — HTTPS redirect, www/non-www, browser caching, gzip compression, security headers — and we'll build a ready-to-deploy .htaccess file for your Apache server.

Redirect any http:// request to https://.

Force www / non-www

Pick one canonical hostname to avoid duplicate-content issues.

/page/ → /page

Long Cache-Control headers for images/fonts/css/js (1 year).

Compress text, CSS, JS, SVG, JSON, and XML.

X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy.

Stops Apache from auto-rendering directory indexes.

Block image hotlinking

Only requests from your domain can embed your images.

.htaccess

Drop this at the root of your site as .htaccess. Test in a staging environment first — a typo can take a site down.

APACHE
# Force HTTPS
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Cache static assets for 1 year
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType image/jpg               "access plus 1 year"
  ExpiresByType image/jpeg              "access plus 1 year"
  ExpiresByType image/gif               "access plus 1 year"
  ExpiresByType image/png               "access plus 1 year"
  ExpiresByType image/webp              "access plus 1 year"
  ExpiresByType image/avif              "access plus 1 year"
  ExpiresByType image/svg+xml           "access plus 1 year"
  ExpiresByType text/css                "access plus 1 year"
  ExpiresByType application/javascript  "access plus 1 year"
  ExpiresByType application/font-woff2  "access plus 1 year"
  ExpiresByType font/woff2              "access plus 1 year"
</IfModule>

# Enable gzip compression
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript
  AddOutputFilterByType DEFLATE application/javascript application/json application/xml
  AddOutputFilterByType DEFLATE image/svg+xml font/ttf font/otf
</IfModule>

# Security headers
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>

# Disable directory listing
Options -Indexes