Does this work for Nginx?

No — .htaccess is an Apache-specific feature handled by mod_rewrite and friends. Nginx ignores .htaccess files entirely; equivalent rules belong in nginx.conf or a site `server { … }` block using `return 301`, `gzip on`, `expires`, and `add_header`. If you're on Nginx use this tool only as a reference for which rules to translate.

Is the order of rules in .htaccess important?

Yes — Apache processes mod_rewrite rules top-to-bottom and stops at the first `[L]` (last) flag, so HTTPS redirects must come before www canonicalization, which must come before any application rewrite. This generator orders the blocks correctly: RewriteEngine → HTTPS → www/non-www → hotlink → user-agent blocks → app rules. Non-rewrite directives (mod_deflate, mod_expires, headers) are independent and can sit anywhere, but we group them by module for readability.

Why force HTTPS in .htaccess vs server config?

Shared hosting often gives you no access to httpd.conf or VirtualHost, so .htaccess is the only place you can write the redirect. On a VPS where you control the server config, prefer a VirtualHost-level `Redirect permanent` — it's slightly faster (no per-request directory walk) and survives if .htaccess is accidentally deleted. Both produce the same user-visible result.

How can I test .htaccess without breaking the live site?

Three safe options. (1) Drop it on a staging subdomain first. (2) Rename your live file to `.htaccess.bak` and the new one to `.htaccess`; if anything 500s, swap them back — Apache rereads on the next request. (3) Run `apachectl configtest` if you have shell access; it catches syntax errors before they hit users. Always keep a backup; a single stray quote can yield "500 Internal Server Error" with no clue in the browser.

My cache headers don't seem to apply — why?

The most common cause is that mod_expires or mod_headers isn't loaded on your host, so the directives are silently ignored. Wrap each block in ` ` (this generator already does) so a missing module degrades gracefully instead of 500ing. The second cause is the browser serving from its own memory cache — hard-reload with Ctrl+Shift+R or check the `Cache-Control` and `Expires` response headers in DevTools → Network. A CDN or reverse proxy in front of Apache can also strip or override them, so verify at the origin first (e.g. `curl -I https://example.com/style.css`).

Force HTTPS on a shared-hosting WordPress site after installing an SSL cert

Your host just issued a free Let's Encrypt cert but the site still loads over http and shows mixed-content warnings. You have no access to httpd.conf. Tick "Force HTTPS" plus "Force www", paste the two rewrite blocks above WordPress's own rules, and every http request 301-redirects to https://www in one hop. Verify with curl -I and watch for a single 301, not a redirect loop.

Cut repeat-visit load time by setting per-type browser cache lifetimes

A landing page reloads its 1.2 MB hero image and CSS on every visit because nothing sets an Expires header. Enable the mod_expires block, give images 1 year, CSS/JS 1 month, and HTML 1 hour. Returning visitors now pull static assets from disk cache, so a 40-request page drops to 3 network requests and feels instant on the second view.

Stop another site from hotlinking your images and burning your bandwidth

Analytics show 60% of your image bandwidth comes from a forum that embeds your product photos directly. Turn on hotlink protection, allow your own domain plus Google Images, and serve a 1px placeholder to everyone else. The forum's embeds break, your origin transfer drops sharply, and legitimate visitors notice nothing.

Open CORS for one front-end origin calling a same-server JSON endpoint

Your React app on app.example.com fetches /api/config.json served by Apache on example.com and the browser blocks it with a CORS error. Add a scoped Access-Control-Allow-Origin for https://app.example.com (not the wildcard *) plus Allow-Methods GET, OPTIONS. The fetch now succeeds, and you avoid the blanket * that would expose the endpoint to every site on the web.

Apache .htaccess Generator — HTTPS, Gzip, Cache, CORS

Generate Apache .htaccess — HTTPS redirect, www toggle, gzip, cache headers, hotlink protection.

Runs locally
Category Generator
Best for Starting from a blank page without committing to the first result.

Presets

RedirectsForce HTTPS (301 redirect)

www canonicalization

Performance headersGzip compression (mod_deflate)Browser cache headers (mod_expires)

SecurityHotlink protection (block images by Referer)

Blocked User-Agents

Custom error pages

Misc

Directory listing

CORS — Access-Control-Allow-Origin

.htaccess preview

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Force HTTPS
  RewriteCond %{HTTPS} off
  RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # Strip www
  RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
  RewriteRule ^(.*)$ https://%1%{REQUEST_URI} [L,R=301]
</IfModule>

<IfModule mod_deflate.c>
  # Gzip compression
  AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript
  AddOutputFilterByType DEFLATE application/javascript application/json application/xml
  AddOutputFilterByType DEFLATE application/xhtml+xml application/rss+xml
  AddOutputFilterByType DEFLATE image/svg+xml font/woff font/woff2 application/font-woff
</IfModule>

<IfModule mod_expires.c>
  # Browser cache (mod_expires)
  ExpiresActive On
  ExpiresDefault "access plus 1 month"
  ExpiresByType text/html "access plus 0 seconds"
  ExpiresByType text/css "access plus 1 year"
  ExpiresByType application/javascript "access plus 1 year"
  ExpiresByType image/jpeg "access plus 1 year"
  ExpiresByType image/png "access plus 1 year"
  ExpiresByType image/webp "access plus 1 year"
  ExpiresByType image/svg+xml "access plus 1 year"
  ExpiresByType image/x-icon "access plus 1 year"
  ExpiresByType font/woff "access plus 1 year"
  ExpiresByType font/woff2 "access plus 1 year"
  ExpiresByType application/json "access plus 0 seconds"
</IfModule>

# Custom error pages
ErrorDocument 404 /404.html
ErrorDocument 500 /500.html

# Directory listing off
Options -Indexes

What this tool does

Free Apache .htaccess builder. Tick the blocks you want — force HTTPS, pick a canonical host (force-www or strip-www), enable gzip via mod_deflate, set browser cache lifetimes per mimeType via mod_expires, block hotlinking by Referer, swap in custom 404 / 500 / 503 error pages, blacklist abusive User-Agents, toggle directory listing, and open CORS for an origin. Output is rebuilt live as you click and ships with comment headers explaining every rule. Copy to clipboard or download the file directly. 100% client-side: nothing is uploaded and there are no external API calls.

Tool details

Input: Files + Text + Numbers; The page exposes text boxes, numeric controls, file pickers, or structured inputs depending on the tool.
Output: Live result + Copy + Download; The result area focuses on usable output, with copy, download, or preview actions when supported.
Privacy: Browser-side processing; The main tool logic does not call an external API, so inputs normally stay in the current tab.
Save / share: No account required; Open the page and use it; whether results survive refresh depends on the tool.
Performance budget: Initial JS <= 18 KB; No WASM budget is declared, keeping the tool quick to open on mobile.
Best fit: Generator · Developer; Category and role tags drive related tools, internal links, and quick fit checks.

How to use

1. Input

Paste or drop your content into the tool panel.
2. Process

Click the button. All processing is local in your browser.
3. Copy / Download

Copy the result or download to disk in one click.

How .htaccess Generator fits into your work

Use it to get a strong first draft, starter asset, or structured output that you can edit before publishing.

Generation jobs

Starting from a blank page without committing to the first result.
Creating repeatable drafts, names, templates, or placeholder assets.
Exploring options before choosing the one that fits the job.

Generation checks

Review generated output before it reaches a customer, page, or document.
Change defaults when you need a specific brand voice, format, or audience.
Keep only the parts that match the real task.

Good next steps

These links move the current task into a more complete workflow.

Real-world use cases

Force HTTPS on a shared-hosting WordPress site after installing an SSL cert
Your host just issued a free Let's Encrypt cert but the site still loads over http and shows mixed-content warnings. You have no access to httpd.conf. Tick "Force HTTPS" plus "Force www", paste the two rewrite blocks above WordPress's own rules, and every http request 301-redirects to https://www in one hop. Verify with curl -I and watch for a single 301, not a redirect loop.
Cut repeat-visit load time by setting per-type browser cache lifetimes
A landing page reloads its 1.2 MB hero image and CSS on every visit because nothing sets an Expires header. Enable the mod_expires block, give images 1 year, CSS/JS 1 month, and HTML 1 hour. Returning visitors now pull static assets from disk cache, so a 40-request page drops to 3 network requests and feels instant on the second view.
Stop another site from hotlinking your images and burning your bandwidth
Analytics show 60% of your image bandwidth comes from a forum that embeds your product photos directly. Turn on hotlink protection, allow your own domain plus Google Images, and serve a 1px placeholder to everyone else. The forum's embeds break, your origin transfer drops sharply, and legitimate visitors notice nothing.
Open CORS for one front-end origin calling a same-server JSON endpoint
Your React app on app.example.com fetches /api/config.json served by Apache on example.com and the browser blocks it with a CORS error. Add a scoped Access-Control-Allow-Origin for https://app.example.com (not the wildcard *) plus Allow-Methods GET, OPTIONS. The fetch now succeeds, and you avoid the blanket * that would expose the endpoint to every site on the web.

Common pitfalls

Using 302 instead of 301 for the HTTPS redirect — 302 is "temporary" so search engines keep indexing the http URL. This generator emits R=301 by default.
Combining force-www and strip-www at once, which creates an infinite redirect loop (www → non-www → www). Pick exactly one canonical host.
Caching HTML for a year like you do for images — visitors get stale pages after a deploy. Keep HTML at access plus 1 hour or shorter and version your static filenames.

Privacy

Everything runs in your browser. The hosts, paths, origins, and User-Agent strings you type are used only to assemble the rule text locally and are never uploaded — there are no API calls and no analytics on your input. The generated config never appears in the page URL, so pasting a domain or a CORS origin here won't leak it into your history or any share link. Copy or download the result; nothing is stored after you close the tab.

FAQ

Tool combos

Folks in your role tend to reach for these alongside this tool.

Browse all tools for this role

Apache .htaccess Generator — HTTPS, Gzip, Cache, CORS

What this tool does

Tool details

How to use

1. Input

2. Process

3. Copy / Download

How .htaccess Generator fits into your work

Generation jobs

Generation checks

Good next steps

Real-world use cases

Force HTTPS on a shared-hosting WordPress site after installing an SSL cert

Cut repeat-visit load time by setting per-type browser cache lifetimes

Stop another site from hotlinking your images and burning your bandwidth

Open CORS for one front-end origin calling a same-server JSON endpoint

Common pitfalls

Privacy

FAQ

robots.txt Generator

Meta Tag Generator

JSON Formatter & Validator

.htpasswd Generator

Markdown TOC Generator

Mock Data Generator

Password Generator

QR Code Generator

UUID Generator

Crontab Helper — Visual Builder & Explainer

24-Point Solver & Game

Chinese Acupoint Locator