Pick the .htaccess Rules You Need

Open a group, tick what applies, and watch the file build itself. Start from a preset if you want a sensible baseline to edit.

Start from a preset

Output uses Apache 2.4 syntax. The access control blocks include the Apache 2.2 equivalent as a comment.

Redirects

Security headers

Access control

Disable directory listing Stops Apache printing a file index when a folder has no index file. Block sensitive files Denies dotfiles plus .env, composer.json, package.json, yarn.lock, and backup or log files left in the web root. Restrict access by IP address IPv4, IPv6 and CIDR ranges all work.

Block these addresses Everyone else stays allowed. Allow only these addresses Everyone else gets 403. Useful on staging or an admin folder.

One address or range per line

Password protect this directory Basic authentication. The hash below is generated in your browser and never leaves the page.

Prompt text (realm)

Absolute path to .htpasswd on the server

Keep this file outside the web root so nobody can download it.

Username Password

Paste this into .htpasswd

Salted APR1-MD5, the format Apache accepts on every platform. Generating again produces a different salt and a different line for the same password, which is expected.

Hotlink protection Blocks other sites from embedding your images and burning your bandwidth. Empty referers stay allowed so direct visits and saved files still work.

Allowed domains, one per line Protected file types Replacement image URL (optional)

Performance

Compression (gzip / deflate) Compresses text responses with mod_deflate. Images and video are already compressed and are left alone. Browser caching Sets Expires and Cache-Control per file type. Long lifetimes need versioned filenames, otherwise visitors keep the old file.

Images CSS JavaScript Fonts HTML

Remove ETags Drops the ETag header so Last-Modified does the validation. Worth doing when the same file is served from several machines.

Other

Custom error pages Point Apache at your own pages. Use a path that starts with a slash, not a full URL, or the status code gets replaced by a redirect.

401 page 403 page 404 page 500 page

Default charset Adds the charset to the Content-Type header of text responses that do not set one.

Charset

WordPress default block The standard front controller rules WordPress writes itself. Keep them last so your own redirects run first. Block bots by user agent Returns 403 to the listed agents. Anyone can fake a user agent, so treat this as noise reduction rather than security.

User agent fragments, one per line

PHP value overrides Only works with mod_php. On PHP-FPM or CGI these lines are ignored, or throw a 500 without the IfModule guard.

Most modern hosts run PHP-FPM. If yours does, set these in php.ini or a .user.ini file instead.

upload_max_filesize post_max_size memory_limit max_execution_time

.htaccess nothing selected yet

everything runs in your browser, nothing is uploaded

How the Generated File Is Put Together

Order matters in an .htaccess file, and getting it wrong produces bugs that look random. Rewrite rules run before caching and header directives. Inside the rewrite block, a whole domain move comes first, then the https redirect, then the canonical hostname, then your individual redirects, and a front controller such as the WordPress block goes last because it swallows everything left over.

The generator sorts all of that for you, so you can tick options in any order and still get a file that behaves. Each block is wrapped in the IfModule guard for the module it needs, which means a server without mod_expires quietly skips the caching block instead of returning a 500 on every request.

Before you upload

Back up whatever is in your web root now. Download a copy rather than renaming the file in place, because .htaccess.bak sitting next to it is still readable over http. Then upload, load the site in a private window, and check the redirect chain rather than the final page: one hop is right, two or more means your rules are arguing with each other.

The setup guide walks through that process properly, including how to tell whether Apache is reading your file at all. Quick questions such as 301 against 302, or www against non-www, are answered on the FAQ page.