How do I create a .htaccess file?

Configure the options above, copy the generated block, and save it as a plain text file named .htaccess (with the leading dot and no file extension) in your site's document root. On cPanel File Manager, enable 'Show Hidden Files' to see it. Apache reads it on the next request — no restart needed.

How do I redirect HTTP to HTTPS in .htaccess?

Turn on 'Force HTTPS'. It emits a mod_rewrite rule that catches any request where %{HTTPS} is off and issues a 301 redirect to the https:// version of the same URL. Add the HSTS security header afterwards so browsers remember to use HTTPS on their own.

How do I set up a 301 redirect in .htaccess?

Open 'Custom 301 / 302 redirects', add a row, enter the old path (starting with /) and the destination URL, and keep the code at 301 for a permanent move. The tool writes a `Redirect 301 /old https://site/new` line using mod_alias, which handles exact-path redirects cleanly.

How do I redirect www to non-www in .htaccess?

Set 'Canonical host' to 'Force non-www'. The rule matches any host that starts with www. and 301-redirects to the same URL on the bare domain. Pair it with Force HTTPS so a visitor on http://www lands on https:// non-www in one canonical hop.

How do I password protect a folder with .htaccess?

Enable 'Password protect this directory', enter the absolute server path to your .htpasswd file and a realm name. The generated AuthType Basic block asks for a login. Create the .htpasswd credentials with the linked htpasswd Generator — the .htaccess only references that file, it doesn't store passwords.

Why is each block wrapped in ?

If a directive needs an Apache module that your host has not loaded, Apache returns HTTP 500 for the whole site. Wrapping mod_rewrite, mod_deflate, mod_expires, mod_headers and mod_alias blocks in makes a missing module skip that block instead of breaking everything. The Basic Auth block is deliberately left unwrapped so a missing auth module fails closed rather than exposing the folder.

Where exactly should I place the .htaccess file?

In your site's document root (often public_html or www) so the rules apply site-wide, or inside a specific folder to scope them there. On WordPress, paste the generated block above the `# BEGIN WordPress` marker so WordPress does not overwrite it when it regenerates its own rules.

Will a wrong rule take my site down?

A malformed mod_rewrite rule can return HTTP 500. This tool only emits directives straight from the Apache 2.4 documentation, guards module blocks with , and checks that every guard is balanced. Still, back up your existing .htaccess first and reload the site once after pasting.

Does this work on Nginx, Caddy or IIS?

No. .htaccess is an Apache feature (also read by LiteSpeed, which is Apache-compatible). Nginx, Caddy and IIS use their own configuration formats and ignore .htaccess entirely. Most .lk shared hosting and cPanel plans run Apache or LiteSpeed, so this file applies there.

Developer · Apache

.htaccess Generator — HTTPS, 301 Redirects & Security

Build a valid Apache .htaccess file from simple toggles: force HTTPS, canonicalise www vs non-www, add 301/302 redirects, password-protect folders, and set caching and security headers. Every module block is <IfModule>-guarded, generated in your browser, nothing uploaded.

By Induwara Ashinsana— Executive Director, Ryzera TechnologiesUpdated Jul 17, 2026

.htaccess Generator

Presets

Primary domain

Hostname only, no https:// or path. Leave blank for domain-agnostic rules.

Force HTTPS

Redirect every HTTP request to HTTPS (301).

Canonical host

Disable directory listing

Stop Apache serving a file list when there is no index file.

GZIP compression

Compress text responses with mod_deflate.

Browser caching

Set far-future cache lifetimes for static assets (mod_expires).

Security headers

X-Frame-Options (clickjacking protection)X-Content-Type-Options (stop MIME sniffing)Referrer-Policy (limit referrer leakage)HSTS (force HTTPS in the browser)

Custom 301 / 302 redirects

None yet — add a row to redirect an old path to a new URL.

Custom error pages

None yet — add a row to serve your own page for a status code.

Hotlink protection

Block other sites from embedding your images.

Password protect this directory

Require an HTTP Basic Auth login (mod_authn_file).

.htaccess

# .htaccess — generated by induwara.lk/tools/htaccess-generator
# Place in your document root, above any CMS-managed block (e.g. # BEGIN WordPress).

# Force HTTPS + canonical host
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]
</IfModule>

# Disable directory listing
Options -Indexes

# GZIP compression
<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript application/json application/xml application/rss+xml image/svg+xml application/x-font-ttf application/vnd.ms-fontobject font/opentype
</IfModule>

# Browser caching
<IfModule mod_expires.c>
ExpiresActive On
ExpiresByType image/jpeg "access plus 1 year"
ExpiresByType image/png "access plus 1 year"
ExpiresByType image/gif "access plus 1 year"
ExpiresByType image/webp "access plus 1 year"
ExpiresByType image/svg+xml "access plus 1 year"
ExpiresByType image/x-icon "access plus 1 year"
ExpiresByType text/css "access plus 1 month"
ExpiresByType application/javascript "access plus 1 month"
ExpiresByType text/html "access plus 0 seconds"
</IfModule>

# Security headers
<IfModule mod_headers.c>
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

40 lines1,489 bytes6 sections

Save this as a plain file named .htaccess(no extension) in your site's document root. Every directive follows the Apache 2.4 docs — sources cited below the tool.

How it works

The generator is a deterministic string builder. Each option you enable appends a documented directive block in the order Apache evaluates configuration: rewrite rules run before content is served, while headers, compression and caching are applied independently. There is no server round-trip — the file is assembled on this page.

Force HTTPS emits a mod_rewrite rule: when %{HTTPS} is off, redirect ^(.*)$ to https://%{HTTP_HOST}%{REQUEST_URI} with the [L,R=301] flags.
Canonical host adds a second rewrite: non-www matches ^www\.(.+)$ and redirects to the captured bare host; www matches hosts that do not start with www and prepends it. Ordered after the HTTPS rule so a single canonical hop reaches https:// + the right host.
Custom redirects use mod_alias — one Redirect 301 /old https://…/new line per row, with the status code taken from the row (301 permanent, 302 temporary).
Error pages, directory listing and Basic Auth use Apache core and mod_authn_file: ErrorDocument, Options -Indexes, and the AuthType Basic … Require valid-user block.
GZIP (mod_deflate), caching (mod_expires), hotlink protection (mod_rewrite with an [F] forbidden flag) and security headers (mod_headers) each append their own block.

Every block that depends on an optional module is wrapped in <IfModule mod_x.c> … </IfModule>, so a host missing that module skips the block instead of returning HTTP 500. The one deliberate exception is the password-protection block: leaving it unwrapped means a missing auth module makes the request fail rather than silently exposing a folder that was supposed to be locked. The tool cross-checks that every <IfModule>guard has a matching close tag before showing the “structure verified” badge. All syntax follows the Apache HTTP Server 2.4 documentation, last verified 2026-07-17.

Worked examples

HTTPS + non-www migration

Domain example.lk, Force HTTPS on, canonical = non-www, directory listing off, first three security headers.

# .htaccess — generated by induwara.lk/tools/htaccess-generator
# Site: example.lk
# Place in your document root, above any CMS-managed block (e.g. # BEGIN WordPress).

# Force HTTPS + canonical host
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]
</IfModule>

# Disable directory listing
Options -Indexes

# Security headers
<IfModule mod_headers.c>
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

A request to http://www.example.lk/contact hits the HTTPS rule → https://www.example.lk/contact, then the www rule → https://example.lk/contact. Two 301 hops, canonical destination reached.

Renamed posts + a custom 404

Two 301 redirects (/2021/old-title → /hello-world, /archive → /posts) and a custom 404 page.

# .htaccess — generated by induwara.lk/tools/htaccess-generator
# Site: blog.lk
# Place in your document root, above any CMS-managed block (e.g. # BEGIN WordPress).

# Custom redirects
<IfModule mod_alias.c>
Redirect 301 /2021/old-title https://blog.lk/hello-world
Redirect 301 /archive https://blog.lk/posts
</IfModule>

# Custom error pages
ErrorDocument 404 /404.html

/2021/old-title issues a permanent redirect; any unknown path renders /404.html with a real 404 status. mod_alias handles the exact-path redirects; ErrorDocument is a core directive, so no IfModule guard is needed.

Password-protect a staging folder

Directory protection on, .htpasswd path /home/exampleusr/.htpasswd, realm 'Staging'.

# .htaccess — generated by induwara.lk/tools/htaccess-generator
# Place in your document root, above any CMS-managed block (e.g. # BEGIN WordPress).

# Password-protect this directory (HTTP Basic Auth)
# Intentionally NOT wrapped in <IfModule>: if the auth module is missing the
# request must fail, never fall open.
AuthType Basic
AuthName "Staging"
AuthUserFile /home/exampleusr/.htpasswd
Require valid-user

Any request under the directory prompts for HTTP Basic Auth, validated against the .htpasswd file made with the htpasswd Generator. The block is intentionally not wrapped in IfModule so a missing auth module fails closed.

Frequently asked questions

Sources & references

The directive syntax on this page was last cross-checked against the Apache HTTP Server 2.4 documentation on 2026-07-17. Back up your existing .htaccess before replacing it, and reload the site once to confirm nothing 500s.

Related tools

LiveDeveloper

LaTeX Editor

Write LaTeX in the browser and see the compiled PDF as you type. Do not know LaTeX? Describe the change you want in plain English and the built-in AI writes it for you. Runs a real TeX engine in an isolated sandbox, so there is nothing to install and your document is never stored.

Open tool

LiveDeveloper

YAML ⇄ JSON Converter

Convert YAML to JSON and JSON to YAML entirely in your browser. Auto-detects direction, expands anchors/aliases and merge keys, handles multi-document streams, locates parse errors by line, and verifies each conversion with a round-trip check. No upload, no signup.

Open tool

LiveDeveloper

JavaScript Playground

Write and run JavaScript online, free, no signup. Code runs in a sandboxed worker in your own browser with live console output.

Open tool

Rate this tool

Be the first to rate

Comments & feedback

Spotted a bug or want an improvement? Tell us — our team reviews every comment, and good ideas get built. Comments are public and anonymous.

Found a bug, edge case, or want to suggest an improvement?

Email me at [email protected] — most fixes ship within 24 hours.

How it works

Worked examples

HTTPS + non-www migration

Renamed posts + a custom 404

Password-protect a staging folder

Frequently asked questions

How do I create a .htaccess file?

How do I redirect HTTP to HTTPS in .htaccess?

How do I set up a 301 redirect in .htaccess?

How do I redirect www to non-www in .htaccess?

How do I password protect a folder with .htaccess?

Why is each block wrapped in <IfModule>?

Where exactly should I place the .htaccess file?

Will a wrong rule take my site down?

Does this work on Nginx, Caddy or IIS?

Sources & references

Related tools

LaTeX Editor

YAML ⇄ JSON Converter

JavaScript Playground

Comments & feedback