Where should the .htaccess file be placed on an Apache web server?

The .htaccess file should be placed in your website's public root directory (typically public_html, htdocs, or /var/www/html). Rules placed in the root directory apply recursively to all subdirectories unless overridden by a child .htaccess file.

Why is testing .htaccess rules in a staging environment critical before production deployment?

A syntax typo or an unsupported Apache module directive in an .htaccess file can cause Apache to return a 500 Internal Server Error, taking your entire website offline. Always create a backup of your existing .htaccess file before making changes.

What is the difference between a 301 and a 302 redirect in .htaccess?

A 301 redirect indicates a permanent URL move, signaling search engines to transfer SEO link equity and update search index records. A 302 redirect indicates a temporary move, instructing search bots to keep the original URL in the index.

How do browser caching rules (mod_expires) improve page speed?

mod_expires directives instruct visitors' web browsers to store static assets (images, CSS, JavaScript, fonts) in local browser cache for a specified duration (e.g., 1 year), eliminating redundant network downloads on repeat visits.

Developer Tools

.htaccess Redirect & Security Generator

Build Apache .htaccess configuration files with HTTPS enforcement, canonical domain redirects, Gzip compression, browser caching, and custom 301 rules.

Domain & HTTPS Redirection

Your Domain Name

Force HTTPS (SSL)

Canonical Domain

Speed & Security Controls

Custom 404 Page

Block Specific IPs (1 per line)

Custom 301 Redirects (2)

→

Generated .htaccess

# ----------------------------------------------------------------------
# FreeToolsBox Generated .htaccess Configuration
# https://freetoolsbox.click/tools/developer/htaccess-generator
# ----------------------------------------------------------------------

RewriteEngine On
RewriteBase /

# 1. Force HTTPS Connection
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# 2. Redirect WWW to Non-WWW
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^(.*)$ https://%1/$1 [R=301,L]

# 3. Disable Directory Browsing & Index Listings
Options -Indexes

# 4. Custom Error Pages
ErrorDocument 404 /404.html

# 5. Block Access to Hidden & Sensitive Files (.env, .git, .htaccess)
<FilesMatch "^(\.|.*\.env|.*\.log|.*\.sql|.*\.bak)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# 8. Custom 301 Permanent Page Redirects
Redirect 301 /old-about-us /about
Redirect 301 /contact-form /contact

# 9. Enable Gzip Compression (mod_deflate)
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript
    AddOutputFilterByType DEFLATE application/javascript application/x-javascript application/json
    AddOutputFilterByType DEFLATE application/xml application/xhtml+xml application/rss+xml
    AddOutputFilterByType DEFLATE image/svg+xml font/ttf font/otf font/woff font/woff2
</IfModule>

# 10. Leverage Browser Caching (mod_expires)
<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresDefault "access plus 1 month"
    ExpiresByType image/x-icon "access plus 1 year"
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType image/webp "access plus 1 year"
    ExpiresByType image/svg+xml "access plus 1 year"
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType application/javascript "access plus 1 month"
    ExpiresByType font/woff2 "access plus 1 year"
</IfModule>

100% Private. Your data never leaves your device.

FreeToolsBox • Instant & Free

What is .htaccess Redirect & Security Generator?

An .htaccess file is a per-directory Apache or LiteSpeed configuration file. It can redirect old URLs, force HTTPS, choose a canonical www version, set browser caching, and block directory listings. This generator creates readable Apache 2.4 rules for those common jobs, plus custom redirects. The five rule groups are redirects, HTTPS forcing, www or non-www canonicalization, caching headers, and blocking rules such as Options -Indexes. Back up your existing file and test on staging first because a syntax or module error can cause a 500 response.

Back up your current configuration and test generated rules on staging before applying them to a live site.

A beginner guide to .htaccess rules

An .htaccess file applies configuration within a directory on supported Apache hosting. The server must allow the relevant overrides and have the required modules enabled. Nginx and Cloudflare Pages use other configuration systems. Start with your domain name, select only rules you need, and review the output. Back up the existing file and test on staging: an invalid directive can produce a server error.

Redirects: Custom 301 Redirects send visitors from an old path to a new destination after a permanent page move. This tool does not offer custom 302 redirects.
HTTPS forcing: redirects plain HTTP requests to HTTPS. A working certificate and correct proxy configuration are still required; it does not install a certificate.
WWW choice: sends requests to your selected www or non-www address so visitors use one consistent domain form.
Browser caching: sets expiry instructions for static assets, reducing repeat downloads when the browser can reuse its local cache.
Blocking: directory-listing protection hides file indexes, while the separate IP field restricts specified addresses. These settings do not replace application security or authentication.

How to Use the .htaccess Redirect & Security Generator

1
Enter "Your Domain Name", enable "Force HTTPS (SSL)" when supported, and choose the "Canonical Domain" option.
2
Toggle the compression, browser caching, directory-listing, and protection rules required by your host.
3
Use "Custom 301 Redirects" to enter old source paths and destination URLs; temporary 302 redirects are not offered.
4
Review the output, click "Copy Code", and test on staging after backing up your existing .htaccess file.

How It Works

Generates Apache 2.4 mod_rewrite and mod_headers directives with [L,R=301] execution flags to ensure permanent canonical redirection without redirect loops.

HTTPS Rewrite: RewriteEngine On 
 RewriteCond %{HTTPS} off 
 RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

.htaccess Redirect & Security Generator Frequently Asked Questions

Related Developer Tools

Explore more free tools in this category

View all in Developer Tools

Popular

JSON Formatter & Validator

Format, beautify, validate, and minify JSON data with line numbers and exact syntax error diagnostics.

Developer ToolsOpen Tool →

CSS Minifier & Beautifier

Minify CSS stylesheets to reduce file size or beautify minified styles with clean indentation.

Developer ToolsOpen Tool →

HTML Minifier & Beautifier

Compress HTML documents by removing comments and whitespace, or format unreadable code into neat tags.

Developer ToolsOpen Tool →

JS Minifier & Beautifier

Format unreadable JavaScript code with proper spacing or strip spaces and comments for fast loading.

Developer ToolsOpen Tool →