.htaccess Generator

Overview

Builds an Apache .htaccess file from four independent toggles: force HTTPS, strip the www prefix, add security headers, and enable gzip compression via mod_deflate. The rules are assembled live as you check boxes, in the standard rewrite-and-headers idiom, and one button copies the whole file. It is a starting point for Apache hosting, not a universal server config.

How It Works

Check the options you want. Force HTTPS adds a RewriteCond on %{HTTPS} with a 301 redirect to the same host and URI over HTTPS. Strip www adds a case-insensitive condition matching a www. host and a 301 to the bare domain. Security headers emit X-Content-Type-Options nosniff, X-Frame-Options SAMEORIGIN, and X-XSS-Protection 1; mode=block via Header always set. Gzip emits an IfModule mod_deflate block applying DEFLATE to HTML, text, XML, CSS, JavaScript and JSON. Copy the result into the .htaccess file at your document root.

Step-by-Step Usage Guide

1. Check Force HTTPS if the site should always load over TLS.
2. Check Strip www to canonicalize the host to the bare domain.
3. Check Security Headers and Gzip as needed for the protection and compression you want.
4. Copy the rules into .htaccess at the site root, then test redirects in a private window before going live.

Technical Specifications & Standards

The generated rewrite block follows the canonical pattern, but order and environment assumptions decide whether it works. The HTTPS redirect runs before the www strip, so http://www.example.com serves two redirects, first to https://www.example.com and then to https://example.com; one combined rule would redirect in a single hop, which matters for latency and for crawl budget. Both rules use R=301, the permanent status, so browsers and CDNs cache them aggressively: test on a staging domain or a non-cached browser profile first, because a mistake in a cached 301 is painful to retract. mod_rewrite must be enabled and, on shared hosts, AllowOverride must permit these directives, or the rules are ignored or return a 500. The Header directives require mod_headers, and the gzip block is safely wrapped in IfModule so servers without mod_deflate skip it rather than failing. One content note: X-XSS-Protection is included here for legacy parity, but the header is deprecated and its auditor was removed from Chrome, so it should not be counted as protection; consider Content-Security-Policy, which the site's separate CSP generator builds. HSTS is not emitted, and adding Strict-Transport-Security is the usual next step once HTTPS is confirmed stable.

Targeted Use Cases

• Canonicalizing a new site to a single HTTPS, non-www host before launch.
• Adding nosniff and frame-options headers on shared Apache hosting where server config is out of reach.
• Enabling text compression on a host with mod_deflate available but not configured.
• Producing a reviewed, minimal baseline .htaccess for a client project handover.

Notes & Gotchas

• Test generated 301s on a staging host first; permanent redirects are cached by browsers and CDNs and are slow to undo.
• Confirm mod_rewrite, mod_headers, and AllowOverride permissions on your host; missing modules are the usual cause of a 500 after pasting.
• Add an HSTS header manually once HTTPS is proven, since this generator does not emit one.
• Do not rely on X-XSS-Protection as security; it is deprecated in modern browsers, so treat CSP as the real mitigation.

Frequently Asked Questions