.htaccess generator
The Apache config file that does the unglamorous work — HTTPS, redirects, caching and the headers that keep you out of trouble.
What do you need it to do?
Tick what you want. Everything is wrapped in a check, so nothing breaks if a module is missing.
Your .htaccess
Before you touch it
Download your current .htaccess first. This file is read on every single request, and a single mistyped line returns a 500 error on every page of your site — including the admin area you would use to fix it. Having the old copy on your desktop turns a disaster into a two-minute restore.
What each section does
| Section | Why it matters |
|---|---|
| Force HTTPS | Stops the insecure version of your site existing. Also stops it competing with itself in search. |
| www or non-www | Pick one. Both working is duplicate content, and it splits your links between two addresses. |
| Compression | Usually cuts HTML, CSS and JS by 60–80%. The single biggest speed win in this file. |
| Browser caching | Repeat visitors stop re-downloading your images and fonts. |
| Security headers | Stops your site being framed by someone else, and stops browsers guessing file types. |
| Block dot-files | Prevents anyone downloading .env or reading your .git folder. This one is not optional. |
Order matters
Apache reads the file top to bottom and applies rewrite rules in sequence. A redirect placed above your HTTPS rule will fire first, sending visitors to an insecure URL that then redirects again. Two redirects instead of one is slower and loses a little link value each hop.
The generator puts things in a sensible order: directory settings, then rewrites (HTTPS first), then performance, then security.
The IfModule wrappers
Every block is wrapped in <IfModule>. That means if your host has not enabled
mod_deflate or mod_expires, the block is skipped instead of crashing the
site. It is the difference between a feature quietly not working and your whole site returning 500.
HSTS deserves a warning
Strict-Transport-Security tells browsers to refuse the insecure version of your site
for a year. That is good security and genuinely hard to undo — if your certificate later lapses,
visitors get a hard error with no way to click through. Only keep it once HTTPS is reliably working and
auto-renewing.
If you are not on Apache
This file does nothing on Nginx, Caddy or IIS, and nothing on most managed hosts like Shopify, Wix or Squarespace. Check what your server actually runs before spending an afternoon on it.
Common questions
Where does the file go?
In your site root, alongside your homepage. The name starts with a dot and has no extension: .htaccess exactly. Rules also apply to every folder beneath it.
My site broke after uploading. What now?
Replace the file with your backup, or rename it to .htaccess-old — the site will come back immediately. Then add the sections back a few at a time to find the one at fault.
Does this work on WordPress?
Yes, but WordPress manages its own block between the # BEGIN WordPress and # END WordPress markers. Put your rules outside those markers, or WordPress will overwrite them.
Is .htaccess bad for performance?
Slightly. Apache reads it on every request. On a server you control, moving these rules into the main config is faster. On shared hosting, .htaccess is usually your only option and the cost is small.
Will this work on Nginx?
No. Nginx does not read .htaccess at all. The same jobs are done in your nginx.conf server block, with different syntax.
Want this checked on your real account?
A tool can only work with the numbers you give it. If you want someone to look at what is actually happening in your ad account, the first conversation is free.
Book a free consultation