.htaccess Generator

Build common Apache rewrite and header rules without memorising the syntax.

Free
No sign-up
Runs in your browser

www

Trailing slash

Custom 404 page

Redirects (from to [301|302], one per line)

Block IP addresses (space or comma separated)

Block image hotlinking — your domain

.htaccess

# Generated by M2Toolkit — test on a staging site first.

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Force HTTPS
  RewriteCond %{HTTPS} off
  RewriteCond %{HTTP:X-Forwarded-Proto} !https
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # Remove www
  RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
  RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]
  RewriteRule ^old-page$ /new-page [L,R=301]
  RewriteRule ^blog/2019$ /blog [L,R=301]
</IfModule>

# Disable directory listings
Options -Indexes

ErrorDocument 404 /404.html

<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/css text/xml application/javascript application/json application/xml image/svg+xml font/woff2
</IfModule>

<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresDefault "access plus 1 hour"
  ExpiresByType text/html "access plus 0 seconds"
  ExpiresByType text/css "access plus 1 year"
  ExpiresByType application/javascript "access plus 1 year"
  ExpiresByType image/webp "access plus 1 year"
  ExpiresByType image/avif "access plus 1 year"
  ExpiresByType image/jpeg "access plus 1 year"
  ExpiresByType image/png "access plus 1 year"
  ExpiresByType image/svg+xml "access plus 1 year"
  ExpiresByType font/woff2 "access plus 1 year"
</IfModule>

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

# Protect sensitive files
<FilesMatch "^(\.env|\.git|composer\.(json|lock)|package(-lock)?\.json)$">
  Require all denied
</FilesMatch>

A mistake in .htaccess can take a site offline with a 500 error. Keep a backup of your current file and test on staging first.

Everything you type is processed in your browser. Nothing you enter is sent to our servers or stored by us.

How to use the .htaccess Generator

Tick the features you need.
Add redirects as “from to” pairs.
Copy the file to your site's root folder — after backing up the old one.

What does this tool do?

.htaccess files configure Apache and LiteSpeed hosting (common on shared hosts and WordPress). Rules are wrapped in IfModule checks so missing modules don't break the site, and sensitive files like .env and .git are blocked when security headers are on. Test on a staging site first.

Everything runs in your browser — nothing you paste is uploaded.

Why use it?

HTTPS and www rules.
Bulk redirects.
Caching and security headers.

Privacy

Everything you type is processed in your browser. Nothing you enter is sent to our servers or stored by us. There's no account to create and nothing to install.

Last reviewed October 4, 2026 by the M2Toolkit team.

Other tools people use alongside the .htaccess generator.

How to use the .htaccess Generator

What does this tool do?

Why use it?

Privacy

Related tools