.htaccess Generator

Q: Where do I put the .htaccess file?

In the top folder of your website — usually public_html, htdocs or www. The file must be named exactly .htaccess, with the dot and no extension. File managers often hide it; turn on “show hidden files”.

Q: How do I redirect HTTP to HTTPS and www to non-www together?

Turn on Force HTTPS and choose Remove www. The rules are written in an order that sends http://www.example.com/page to https://example.com/page in a single redirect.

Q: Does this work with WordPress?

Yes. Choose the WordPress preset: your rules are placed above the standard # BEGIN WordPress block, which WordPress keeps rewriting on its own. Anything above that block is left alone.

Switch on what your site needs — HTTPS, redirects, security headers, password protection, compression, caching — and get a commented .htaccess file for Apache 2.4 that warns you about mistakes before you upload it.

Runs in your browser Free · no sign-up Works on any device

Start from

Your site’s domain (optional)

Needed only for “add www” on one domain and for moving from an old domain.

HTTPS and www1

Force HTTPSSend every http:// request to https:// with a permanent (301) redirect.Behind Cloudflare or a load balancerTurn on if HTTPS ends before your server (Cloudflare “Flexible” SSL, AWS load balancer) — otherwise the redirect can loop for ever.

www

Pick one address for the site, so search engines do not see two copies of every page.

Slash at the end of URLs

HSTSTell browsers to use only HTTPS for this site for the next year. Hard to undo — switch on once HTTPS works everywhere.

Moving from an old domain?

Every page on the old domain is sent to the same page on your site’s domain. Upload this file to the old domain’s folder as well.

Moved and removed pages

Or paste a list

One per line: the old path, then the new one, separated by a space, comma or tab. A line with only an old path becomes “410 gone”.

Error pages1

404 — Not found

403 — Forbidden

500 — Server error

503 — Unavailable

Give a path on your site that starts with “/”. The visitor sees your page and still receives the right status code.

Security4

Turn off folder listingsA folder with no index page shows “403 Forbidden” instead of a list of its files.Hide files starting with a dot.env, .git, .htpasswd and the like answer “404 Not Found”. /.well-known/ stays open for certificates.Block backups, logs and config files.sql, .bak, .log, .ini, .sh, composer.json, package.json, wp-config.php and similar.Security headersX-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy.

May other sites show yours in a frame?

Upgrade insecure requestsBrowsers load http:// images and scripts on your pages over https:// instead — fixes “mixed content” warnings.Hide the server version on error pagesBlock WordPress xmlrpc.phpA common target of password guessing. Leave open if you use the WordPress app or Jetpack.

IP addresses

Stop other sites embedding your imagesImages still open on your own pages and when visited directly.Block crawlers by nameFor bots that ignore robots.txt. Polite crawlers are better turned away in robots.txt.

Password protection

Ask for a user name and passwordProtects the folder this .htaccess is in, and everything under it.

Make a line for the .htpasswd file

The password is hashed with bcrypt in your browser and is not sent or saved anywhere. Put the line in a file named .htpasswd, one line per user.

User name

Password

Speed2

Compress text filesHTML, CSS, JavaScript, JSON, SVG and fonts are sent with Brotli or gzip, which makes them much smaller.

Browser caching

Styles, scripts and images are kept for a month, fonts for a year. Pages are always checked for changes.

Remove ETagsUseful when several servers share the site; otherwise leave off.

URLs, files and PHP1

Hide file extensions

/about shows about.html, and /about.html redirects to /about.

Unknown URLs go to

Index file (optional)

Which file opens for a folder, in order of preference.

Allow other sites to load (CORS)

Serve text as UTF-8Stops accented letters and symbols appearing as “Ã©”.Add newer file types.webp, .avif, .woff2, .webmanifest, .wasm and .mjs, for servers that do not know them.Raise PHP limitsUpload size, memory and time. Works where PHP runs as an Apache module; skipped elsewhere.

.htaccess109 lines

# .htaccess for Apache 2.4 - made with the JustTools .htaccess Generator
# Upload it to the top folder of your site (often public_html) and test the site straight away.

# ----------------------------------------------------------------------
# Basics
# ----------------------------------------------------------------------
AddDefaultCharset UTF-8
ErrorDocument 404 /404.html

# ----------------------------------------------------------------------
# Folder listings and server details
# A folder without an index page shows "403 Forbidden" instead of a list of
# its files.
# ----------------------------------------------------------------------
Options -Indexes

# ----------------------------------------------------------------------
# Hidden files and folders
# Anything whose name starts with a dot (.env, .git, .htpasswd) answers "404
# Not Found". The .well-known folder stays open - certificates need it.
# ----------------------------------------------------------------------
<IfModule mod_alias.c>
    RedirectMatch 404 "/\.(?!well-known(?:/|$))"
</IfModule>

# ----------------------------------------------------------------------
# Backups, logs and configuration files
# Files that are often left on a server by accident and can leak passwords or
# source code.
# ----------------------------------------------------------------------
<FilesMatch "(?i)(\.(bak|backup|dist|ini|log|old|orig|save|sh|sql|swo|swp|tmp)|~)$">
    Require all denied
</FilesMatch>
<FilesMatch "(?i)^(composer\.(json|lock)|package(-lock)?\.json|wp-config\.php|readme\.html|license\.txt)$">
    Require all denied
</FilesMatch>

# ----------------------------------------------------------------------
# Redirects and rewrites
# ----------------------------------------------------------------------
<IfModule mod_rewrite.c>
    RewriteEngine On

    # http:// -> https://
    RewriteCond %{HTTPS} !=on
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

# ----------------------------------------------------------------------
# Headers
# Stops browsers guessing file types, limits framing by other sites, trims
# what is sent in the Referer header and switches off camera, microphone and
# location for embedded content.
# ----------------------------------------------------------------------
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
    Header always unset X-Powered-By
    Header unset X-Powered-By
</IfModule>

# ----------------------------------------------------------------------
# Compression
# Text files are sent compressed - Brotli where the server and browser have
# it, gzip otherwise. Images and videos are compressed already and are left
# alone.
# ----------------------------------------------------------------------
<IfModule mod_brotli.c>
    <IfModule mod_filter.c>
        AddOutputFilterByType BROTLI_COMPRESS text/html text/plain text/css text/javascript text/xml application/javascript application/json application/ld+json application/manifest+json application/xml application/xhtml+xml application/rss+xml application/atom+xml application/wasm image/svg+xml image/x-icon font/ttf font/otf
    </IfModule>
</IfModule>
<IfModule mod_deflate.c>
    <IfModule mod_filter.c>
        AddOutputFilterByType DEFLATE text/html text/plain text/css text/javascript text/xml application/javascript application/json application/ld+json application/manifest+json application/xml application/xhtml+xml application/rss+xml application/atom+xml application/wasm image/svg+xml image/x-icon font/ttf font/otf
    </IfModule>
</IfModule>

# ----------------------------------------------------------------------
# Browser caching
# Pages are always checked for a new version; styles and scripts are kept for
# 1 month, images for 1 month and fonts for 1 year.
# ----------------------------------------------------------------------
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresDefault "access plus 1 hour"
    ExpiresByType text/html "access plus 0 seconds"
    ExpiresByType application/json "access plus 0 seconds"
    ExpiresByType application/xml "access plus 0 seconds"
    ExpiresByType application/manifest+json "access plus 1 week"
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType text/javascript "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
    ExpiresByType image/avif "access plus 1 month"
    ExpiresByType image/gif "access plus 1 month"
    ExpiresByType image/jpeg "access plus 1 month"
    ExpiresByType image/png "access plus 1 month"
    ExpiresByType image/svg+xml "access plus 1 month"
    ExpiresByType image/webp "access plus 1 month"
    ExpiresByType image/x-icon "access plus 1 month"
    ExpiresByType video/mp4 "access plus 1 month"
    ExpiresByType video/webm "access plus 1 month"
    ExpiresByType font/woff2 "access plus 1 year"
    ExpiresByType font/woff "access plus 1 year"
    ExpiresByType font/ttf "access plus 1 year"
    ExpiresByType font/otf "access plus 1 year"
</IfModule>

Explain each part in commentsSkip rules whose module is missingWraps rules in <IfModule>, so a missing module cannot break the site.

The download is named htaccess.txt, because browsers and computers hide or rename files that start with a dot. On the server, rename it to .htaccess. Keep a copy of the old file first: if the site shows “500 Internal Server Error”, put the old one back.

At a glance

Builds an .htaccess file for Apache 2.4 from switches and short forms: HTTPS, www, redirects, error pages, security, passwords, compression, caching and URL rewriting.
Every kind of rule was loaded into a real Apache 2.4 server and checked with requests while the tool was built.
Rules that need an optional module are wrapped in <IfModule>, so a server without it skips them instead of showing “500 Internal Server Error”.
Redirects can be 301, 302, 307, 308 or 410, for one URL, a whole folder or a regular expression — or pasted as a list. Loops, missing targets and duplicates are flagged.
The HTTPS and www rules are ordered so that http://www. reaches https:// without www in one redirect, with an option for sites behind Cloudflare or a load balancer.
Includes an .htpasswd line maker: the password is hashed with bcrypt in your browser, in the $2y$ form Apache expects.
Presets for a typical site, WordPress, a static site or single-page app, and a PHP app.
Runs in your browser. Your domain, redirects and passwords are not uploaded; your choices are saved on your device only.

Step by step

How to create an .htaccess file

1
Pick a starting point
Choose Recommended basics, WordPress, Static site or SPA or PHP app — or start empty.
2
Switch on what you need
Open each group — HTTPS and www, redirects, security, speed — and turn rules on. Read any warning that appears above the file.
3
Download the file
Click Download (or Copy). The file is saved as htaccess.txt because computers hide files that start with a dot.
4
Upload and rename
Keep a copy of your current .htaccess, upload the new file to the top folder of the site (often public_html) and rename it to .htaccess.
5
Test straight away
Open the site, an old URL you redirected and a page that does not exist. If you see “500 Internal Server Error”, put the old file back.

Features

Everything you need, nothing you don’t

Explained, not just generated

Each section of the file starts with a comment saying what it does, so you can read it again in a year. Switch the comments off for a compact file.

Catches mistakes first

A redirect to itself, a relative .htpasswd path, an invalid IP address, HSTS without HTTPS — each is pointed out before the file reaches your server.

Safe by default

Module checks keep a missing module from taking the site down, and hidden files such as .env and .git are closed while /.well-known/ stays open for certificates.

Redirects in bulk

Paste old and new paths from a spreadsheet, one pair per line. A line with only an old path becomes “410 Gone”.

Password protection with the hash

Get both halves: the rules for .htaccess and the bcrypt line for .htpasswd, for a whole folder or a single file.

Private

Nothing is sent to a server: the file is written, and the password hashed, in your browser.

What each option writes

Option	Rule	Effect
Force HTTPS	`RewriteCond %{HTTPS} !=on` then `RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]`	http:// goes to https://, keeping the path and query
Remove www	`RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]`	www.example.com goes to example.com
Moved page	`RedirectMatch 301 ^/old-page/?$ /new-page`	that URL only, with or without a final slash
Moved folder	`Redirect 301 /blog /news`	/blog/post goes to /news/post
Removed page	`RedirectMatch gone ^/old-page/?$`	“410 Gone”: the page was removed on purpose
Folder listings off	`Options -Indexes`	a folder without an index page shows 403
Hide dot files	`RedirectMatch 404 "/\.(?!well-known(?:/\|$))"`	.env and .git answer 404
Custom 404 page	`ErrorDocument 404 /404.html`	your page, still with status 404
Caching	`ExpiresByType text/css "access plus 1 month"`	returning visitors reuse the file
Compression	`AddOutputFilterByType DEFLATE text/html …`	text is sent with gzip, or Brotli where available

Which redirect code to use

Code	Meaning	Use it when
301	Moved permanently	a page or site has a new address for good — search engines move its ranking to the new URL
302	Found (temporary)	the page will come back, such as during maintenance or a short campaign
307	Temporary, method kept	as 302, when forms that POST must keep working
308	Permanent, method kept	as 301, for APIs and forms that POST
410	Gone	the page was removed on purpose and has no replacement

Before you upload

.htaccess works on Apache and LiteSpeed. Nginx ignores it — check with your host if you are unsure which server you have.
The file belongs in the site’s top folder. Rules apply to that folder and everything under it.
The rewrite rules assume the site is at the root of the domain, not in a subfolder such as example.com/shop/.
One mistyped line anywhere in the file causes “500 Internal Server Error” on every page. Keep the old file so you can restore it in seconds.
Behind Cloudflare’s “Flexible” SSL or a load balancer, switch on Behind Cloudflare or a load balancer. Without it, Force HTTPS redirects for ever.
Browsers remember 301 redirects and HSTS for a long time. Test with 302 first if you are unsure, and leave HSTS off until HTTPS works on every page.
For PHP that does not run as an Apache module (PHP-FPM, most shared hosts today), the PHP limits are skipped; put them in a .user.ini file instead.

FAQ

Frequently asked questions

Where do I put the .htaccess file?

In the top folder of your website — usually public_html, htdocs or www. The file must be named exactly .htaccess, with the dot and no extension. File managers often hide it; turn on “show hidden files”.

Why is the download called htaccess.txt?

Browsers and operating systems hide or rename files whose names start with a dot. Upload htaccess.txt and rename it to .htaccess on the server, or use Copy and paste into your host’s file editor.

My site shows “500 Internal Server Error” after uploading. What now?

Put your previous .htaccess back (or rename the new one) and the site returns at once. The usual causes are a module your host has disabled or a rule your host does not allow in .htaccess. Keep Skip rules whose module is missing on, then add the groups back one at a time to find the one your server rejects.

How do I redirect HTTP to HTTPS and www to non-www together?

Turn on Force HTTPS and choose Remove www. The rules are written in an order that sends http://www.example.com/page to https://example.com/page in a single redirect.

Is the password I type for .htpasswd safe?

Yes. It is hashed with bcrypt inside your browser and never leaves it; only the finished line is shown. It is not saved with your other choices either.

Does this work with WordPress?

Yes. Choose the WordPress preset: your rules are placed above the standard # BEGIN WordPress block, which WordPress keeps rewriting on its own. Anything above that block is left alone.

Will it work on Nginx or IIS?

No. .htaccess is read by Apache and LiteSpeed only. Nginx needs the same rules in its server configuration, and IIS uses web.config.

Are my settings stored anywhere?

Only in your browser’s local storage, so they are still there when you come back. Nothing is uploaded. Clearing the site data for JustTools removes them.

Keep going

New

Robots.txt Generator

Create a robots.txt file free: block admin pages, AI training bots like GPTBot or SEO crawlers, add your sitemap, then test any URL against Google’s rules.

SEO & Marketing ToolsOpen

New

Sitemap Generator

Free XML sitemap generator: crawl your site or paste URLs, skip noindex, redirected and robots.txt-blocked pages, add lastmod and images, ready for Google.

SEO & Marketing ToolsOpen

New

Bcrypt Generator & Checker

Generate bcrypt hashes with cost 4–16 and $2a/$2b/$2y prefixes, or check a password against a bcrypt hash. Explains each part. Runs in your browser only.

Security ToolsOpen

New

Website SEO Checker

Free website SEO checker: audit any page’s title, meta description, headings, canonical, robots.txt, schema, Open Graph and AI crawler access, with fixes.

SEO & Marketing ToolsOpen

New

JSON Formatter & Validator

Format, validate, minify and repair JSON online. Get the exact line and column of every error, a collapsible tree view and sorted keys — private, in-browser.

Developer ToolsOpen

New

XML to JSON Converter

Convert XML to JSON and JSON to XML online. Keeps attributes, arrays and leading zeros intact, shows exact error lines and never uploads your data.

Developer ToolsOpen

Browse every tool

Last updated 14 October 2026Report a problem or suggest a feature

Make a line for the .htpasswd file

At a glance

How to create an .htaccess file

Pick a starting point

Switch on what you need

Download the file

Upload and rename

Test straight away

Everything you need, nothing you don’t

Explained, not just generated

Catches mistakes first

Safe by default

Redirects in bulk

Password protection with the hash

Private

What each option writes

Which redirect code to use

Before you upload

Frequently asked questions

Where do I put the .htaccess file?

Why is the download called htaccess.txt?

My site shows “500 Internal Server Error” after uploading. What now?

How do I redirect HTTP to HTTPS and www to non-www together?

Is the password I type for .htpasswd safe?

Does this work with WordPress?

Will it work on Nginx or IIS?

Are my settings stored anywhere?

Related tools

Robots.txt Generator

Sitemap Generator

Bcrypt Generator & Checker

Website SEO Checker

JSON Formatter & Validator

XML to JSON Converter

Make a line for the .htpasswd file