.htaccess Generator

A comprehensive guide to generating and configuring Apache .htaccess files for URL rewriting, security headers, caching, redirects, and performance optimization.

Table of Contents

Introduction
URL Rewriting
Security Headers
Cache Control
Redirects
Performance Optimization
Access Control
Complete Examples
Best Practices

Introduction

The .htaccess file is a powerful configuration file for Apache web servers that allows per-directory configuration changes.

Basic Structure

# Enable rewrite engine
RewriteEngine On

# Custom error pages
ErrorDocument 404 /errors/404.html
ErrorDocument 500 /errors/500.html

# Server settings
Options -Indexes
ServerSignature Off

URL Rewriting

Basic Rewrite Rules

# Enable mod_rewrite
RewriteEngine On
RewriteBase /

# Force HTTPS
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

# Remove www prefix
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ https://%1/$1 [R=301,L]

# Or force www prefix
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteCond %{HTTP_HOST} !^localhost [NC]
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}/$1 [R=301,L]

# Remove trailing slash
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} (.+)/$
RewriteRule ^ %1 [R=301,L]

# Add trailing slash to directories
RewriteCond %{REQUEST_FILENAME} -d
RewriteCond %{REQUEST_URI} !(.+)/$
RewriteRule ^(.+)$ $1/ [R=301,L]

# Remove .html extension
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^([^\.]+)$ $1.html [NC,L]

# Remove .php extension
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^([^\.]+)$ $1.php [NC,L]

# Clean URL routing for single page app
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.html [L]

Advanced Rewriting

# API routing
RewriteRule ^api/users/?$ api/users.php [L]
RewriteRule ^api/users/([0-9]+)/?$ api/users.php?id=$1 [L]
RewriteRule ^api/posts/?$ api/posts.php [L]
RewriteRule ^api/posts/([0-9]+)/?$ api/posts.php?id=$1 [L]

# Pretty URLs for blog
RewriteRule ^blog/([0-9]{4})/([0-9]{2})/([0-9]{2})/([a-z0-9\-]+)/?$ blog/post.php?year=$1&month=$2&day=$3&slug=$4 [L]

# User profile URLs
RewriteRule ^user/([a-zA-Z0-9_-]+)/?$ profile.php?username=$1 [L]

# Category and tag pages
RewriteRule ^category/([a-z0-9\-]+)/?$ category.php?slug=$1 [L]
RewriteRule ^tag/([a-z0-9\-]+)/?$ tag.php?slug=$1 [L]

# Search with query string
RewriteRule ^search/([^/]+)/?$ search.php?q=$1 [L]

# Language prefix routing
RewriteRule ^(en|es|fr|de)/(.*)$ $2?lang=$1 [L,QSA]

# Subdomain to query parameter
RewriteCond %{HTTP_HOST} ^([^.]+)\.example\.com$ [NC]
RewriteCond %{HTTP_HOST} !^www\.example\.com$ [NC]
RewriteRule ^(.*)$ /index.php?subdomain=%1&path=$1 [L,QSA]

# Block specific user agents
RewriteCond %{HTTP_USER_AGENT} (bot|crawler|spider) [NC]
RewriteRule .* - [F,L]

Conditional Rewrites

# Only rewrite if file doesn't exist
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?route=$1 [L,QSA]

# Rewrite based on request method
RewriteCond %{REQUEST_METHOD} ^POST$
RewriteRule ^api/(.*)$ api-post.php?endpoint=$1 [L]

RewriteCond %{REQUEST_METHOD} ^GET$
RewriteRule ^api/(.*)$ api-get.php?endpoint=$1 [L]

# Rewrite based on query string
RewriteCond %{QUERY_STRING} ^oldparam=(.*)$
RewriteRule ^(.*)$ $1?newparam=%1 [R=301,L]

# Rewrite based on referrer
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?example\.com [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ - [F,L]

# Environment-based rewriting
RewriteCond %{HTTP_HOST} ^dev\.example\.com$ [NC]
RewriteRule ^(.*)$ /development/$1 [L]

RewriteCond %{HTTP_HOST} ^staging\.example\.com$ [NC]
RewriteRule ^(.*)$ /staging/$1 [L]

Security Headers

Essential Security Headers

# HTTP Strict Transport Security (HSTS)
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

# X-Frame-Options (prevent clickjacking)
Header always set X-Frame-Options "SAMEORIGIN"

# X-Content-Type-Options (prevent MIME sniffing)
Header always set X-Content-Type-Options "nosniff"

# X-XSS-Protection
Header always set X-XSS-Protection "1; mode=block"

# Referrer Policy
Header always set Referrer-Policy "strict-origin-when-cross-origin"

# Content Security Policy (CSP)
Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.example.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https://api.example.com; frame-ancestors 'self'"

# Permissions Policy (formerly Feature Policy)
Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"

# Remove sensitive server information
Header always unset X-Powered-By
Header unset X-Powered-By
ServerSignature Off

Advanced CSP Configuration

# Strict CSP for production
<IfModule mod_headers.c>
  # Base policy
  Header always set Content-Security-Policy "\
    default-src 'self'; \
    script-src 'self' https://cdn.example.com; \
    style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; \
    font-src 'self' https://fonts.gstatic.com; \
    img-src 'self' data: https: blob:; \
    media-src 'self' https://media.example.com; \
    object-src 'none'; \
    frame-src 'self' https://www.youtube.com https://player.vimeo.com; \
    frame-ancestors 'self'; \
    base-uri 'self'; \
    form-action 'self'; \
    upgrade-insecure-requests; \
    block-all-mixed-content"

  # Report violations
  Header always append Content-Security-Policy-Report-Only "default-src 'self'; report-uri /csp-report"
</IfModule>

# CSP for development
<If "%{HTTP_HOST} == 'localhost' || %{HTTP_HOST} == 'dev.example.com'">
  Header always set Content-Security-Policy "\
    default-src 'self' 'unsafe-inline' 'unsafe-eval'; \
    script-src 'self' 'unsafe-inline' 'unsafe-eval'; \
    style-src 'self' 'unsafe-inline'"
</If>

CORS Headers

# Enable CORS for specific origin
<IfModule mod_headers.c>
  SetEnvIf Origin "^https?://(www\.)?(example\.com|api\.example\.com)$" ORIGIN_ALLOWED=$0

  Header always set Access-Control-Allow-Origin "%{ORIGIN_ALLOWED}e" env=ORIGIN_ALLOWED
  Header always set Access-Control-Allow-Credentials "true" env=ORIGIN_ALLOWED
  Header always set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
  Header always set Access-Control-Allow-Headers "Content-Type, Authorization, X-Requested-With"
  Header always set Access-Control-Max-Age "3600"

  # Handle preflight requests
  RewriteCond %{REQUEST_METHOD} OPTIONS
  RewriteRule ^(.*)$ $1 [R=204,L]
</IfModule>

# Allow all origins (development only - NOT for production)
<IfModule mod_headers.c>
  Header always set Access-Control-Allow-Origin "*"
  Header always set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
  Header always set Access-Control-Allow-Headers "Content-Type, Authorization"
</IfModule>

Cache Control

Browser Caching

<IfModule mod_expires.c>
  ExpiresActive On

  # Default expiration
  ExpiresDefault "access plus 1 month"

  # HTML (no cache)
  ExpiresByType text/html "access plus 0 seconds"

  # CSS and JavaScript
  ExpiresByType text/css "access plus 1 year"
  ExpiresByType application/javascript "access plus 1 year"
  ExpiresByType application/x-javascript "access plus 1 year"

  # Images
  ExpiresByType image/jpg "access plus 1 year"
  ExpiresByType image/jpeg "access plus 1 year"
  ExpiresByType image/gif "access plus 1 year"
  ExpiresByType image/png "access plus 1 year"
  ExpiresByType image/svg+xml "access plus 1 year"
  ExpiresByType image/webp "access plus 1 year"
  ExpiresByType image/x-icon "access plus 1 year"

  # Fonts
  ExpiresByType font/ttf "access plus 1 year"
  ExpiresByType font/otf "access plus 1 year"
  ExpiresByType font/woff "access plus 1 year"
  ExpiresByType font/woff2 "access plus 1 year"
  ExpiresByType application/font-woff "access plus 1 year"

  # Media
  ExpiresByType audio/ogg "access plus 1 year"
  ExpiresByType video/mp4 "access plus 1 year"
  ExpiresByType video/webm "access plus 1 year"

  # Documents
  ExpiresByType application/pdf "access plus 1 month"

  # Data
  ExpiresByType application/json "access plus 0 seconds"
  ExpiresByType application/xml "access plus 0 seconds"
  ExpiresByType text/xml "access plus 0 seconds"
</IfModule>

Cache-Control Headers

<IfModule mod_headers.c>
  # Default cache control
  Header set Cache-Control "public, max-age=2592000"

  # HTML - no cache
  <FilesMatch "\.(html|htm)$">
    Header set Cache-Control "no-cache, no-store, must-revalidate"
    Header set Pragma "no-cache"
    Header set Expires "0"
  </FilesMatch>

  # CSS and JavaScript - cache for 1 year
  <FilesMatch "\.(css|js)$">
    Header set Cache-Control "public, max-age=31536000, immutable"
  </FilesMatch>

  # Images - cache for 1 year
  <FilesMatch "\.(jpg|jpeg|png|gif|svg|webp|ico)$">
    Header set Cache-Control "public, max-age=31536000, immutable"
  </FilesMatch>

  # Fonts - cache for 1 year
  <FilesMatch "\.(woff|woff2|ttf|otf|eot)$">
    Header set Cache-Control "public, max-age=31536000, immutable"
  </FilesMatch>

  # Media - cache for 1 year
  <FilesMatch "\.(mp4|webm|ogg|mp3)$">
    Header set Cache-Control "public, max-age=31536000"
  </FilesMatch>

  # API responses - no cache
  <FilesMatch "\.php$">
    Header set Cache-Control "no-cache, no-store, must-revalidate, private"
  </FilesMatch>
</IfModule>

ETags and Validation

# Enable ETags
FileETag MTime Size

# Or disable ETags (for multi-server setups)
FileETag None
Header unset ETag

# Enable Last-Modified headers
<IfModule mod_headers.c>
  <FilesMatch "\.(html|css|js|jpg|jpeg|png|gif|svg)$">
    Header set Last-Modified "%{LAST_MODIFIED}e"
  </FilesMatch>
</IfModule>

Redirects

Common Redirects

# Redirect single page
Redirect 301 /old-page.html /new-page.html

# Redirect directory
Redirect 301 /old-directory/ /new-directory/

# Redirect to external site
Redirect 301 /external https://example.com

# Redirect with query string preservation
RedirectMatch 301 ^/old-page\.html$ /new-page.html

# Multiple redirects
Redirect 301 /about-us.html /about
Redirect 301 /contact-us.html /contact
Redirect 301 /products.html /shop

# Redirect non-www to www
RewriteCond %{HTTP_HOST} ^example\.com$ [NC]
RewriteRule ^(.*)$ https://www.example.com/$1 [R=301,L]

# Redirect www to non-www
RewriteCond %{HTTP_HOST} ^www\.example\.com$ [NC]
RewriteRule ^(.*)$ https://example.com/$1 [R=301,L]

# Force HTTPS
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

# Redirect old domain to new domain
RewriteCond %{HTTP_HOST} ^(www\.)?olddomain\.com$ [NC]
RewriteRule ^(.*)$ https://newdomain.com/$1 [R=301,L]

# Redirect mobile users
RewriteCond %{HTTP_USER_AGENT} "android|blackberry|iphone|ipad|ipod|opera mini|iemobile" [NC]
RewriteRule ^(.*)$ https://m.example.com/$1 [R=302,L]

Pattern-Based Redirects

# Redirect all .html files to extension-less URLs
RedirectMatch 301 ^/(.*)\.html$ /$1

# Redirect product pages with new URL structure
RedirectMatch 301 ^/products/([0-9]+)$ /product/$1

# Redirect blog posts
RedirectMatch 301 ^/blog/([0-9]{4})-([0-9]{2})-([0-9]{2})/(.*)$ /blog/$1/$2/$3/$4

# Redirect using regex groups
RewriteRule ^category/([^/]+)/page/([0-9]+)$ /shop/$1?page=$2 [R=301,L]

# Conditional redirect based on query string
RewriteCond %{QUERY_STRING} ^id=([0-9]+)$
RewriteRule ^product\.php$ /product/%1? [R=301,L]

Performance Optimization

Compression

<IfModule mod_deflate.c>
  # Enable compression
  AddOutputFilterByType DEFLATE text/html
  AddOutputFilterByType DEFLATE text/css
  AddOutputFilterByType DEFLATE text/javascript
  AddOutputFilterByType DEFLATE text/xml
  AddOutputFilterByType DEFLATE text/plain
  AddOutputFilterByType DEFLATE application/javascript
  AddOutputFilterByType DEFLATE application/x-javascript
  AddOutputFilterByType DEFLATE application/json
  AddOutputFilterByType DEFLATE application/xml
  AddOutputFilterByType DEFLATE application/xhtml+xml
  AddOutputFilterByType DEFLATE application/rss+xml
  AddOutputFilterByType DEFLATE application/atom_xml
  AddOutputFilterByType DEFLATE application/x-font-ttf
  AddOutputFilterByType DEFLATE application/x-font-otf
  AddOutputFilterByType DEFLATE font/truetype
  AddOutputFilterByType DEFLATE font/opentype
  AddOutputFilterByType DEFLATE image/svg+xml

  # Don't compress images
  SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png|webp)$ no-gzip dont-vary

  # Handle browser issues
  BrowserMatch ^Mozilla/4 gzip-only-text/html
  BrowserMatch ^Mozilla/4\.0[678] no-gzip
  BrowserMatch \bMSIE !no-gzip !gzip-only-text/html

  # Add Vary header
  Header append Vary User-Agent env=!dont-vary
</IfModule>

# Gzip compression fallback
<IfModule !mod_deflate.c>
  <IfModule mod_gzip.c>
    mod_gzip_on Yes
    mod_gzip_dechunk Yes
    mod_gzip_item_include file \.(html?|txt|css|js|php|pl)$
    mod_gzip_item_include mime ^text/.*
    mod_gzip_item_include mime ^application/x-javascript.*
    mod_gzip_item_exclude mime ^image/.*
    mod_gzip_item_exclude rspheader ^Content-Encoding:.*gzip.*
  </IfModule>
</IfModule>

Brotli Compression

<IfModule mod_brotli.c>
  AddOutputFilterByType BROTLI_COMPRESS text/html text/plain text/xml text/css text/javascript
  AddOutputFilterByType BROTLI_COMPRESS application/javascript application/json application/xml
  AddOutputFilterByType BROTLI_COMPRESS application/x-javascript application/xhtml+xml
  AddOutputFilterByType BROTLI_COMPRESS application/rss+xml application/atom_xml
  AddOutputFilterByType BROTLI_COMPRESS image/svg+xml

  # Set compression quality (0-11, higher = better compression but slower)
  BrotliCompressionQuality 6
</IfModule>

HTTP/2 Server Push

<IfModule mod_http2.c>
  # Enable HTTP/2
  Protocols h2 h2c http/1.1

  # Server push for critical resources
  <FilesMatch "\.html$">
    Header add Link "</css/main.css>; rel=preload; as=style"
    Header add Link "</js/main.js>; rel=preload; as=script"
    Header add Link "</fonts/main.woff2>; rel=preload; as=font; crossorigin"
  </FilesMatch>
</IfModule>

Access Control

Directory Protection

# Protect directory with password
AuthType Basic
AuthName "Restricted Area"
AuthUserFile /path/to/.htpasswd
Require valid-user

# Allow specific IP addresses
Require ip 192.168.1.100
Require ip 10.0.0.0/8

# Deny specific IP addresses
<RequireAll>
  Require all granted
  Require not ip 192.168.1.50
  Require not ip 10.0.0.100
</RequireAll>

# Protect specific files
<Files "config.php">
  Require all denied
</Files>

<FilesMatch "\.(env|log|ini)$">
  Require all denied
</FilesMatch>

# Protect directories
<Directory "/var/www/admin">
  Require all denied
</Directory>

# Block access to hidden files
<FilesMatch "^\.">
  Require all denied
</FilesMatch>

# Prevent directory listing
Options -Indexes

# Block access to backup files
<FilesMatch "\.(bak|backup|old|tmp|swp)$">
  Require all denied
</FilesMatch>

IP-Based Access Control

# Allow only specific IPs
<RequireAll>
  Require ip 192.168.1.100
  Require ip 192.168.1.101
  Require ip 10.0.0.0/24
</RequireAll>

# Block specific IPs
<RequireAll>
  Require all granted
  Require not ip 192.168.1.50
  Require not ip 10.0.0.100
</RequireAll>

# Allow local network
<RequireAny>
  Require ip 192.168.0.0/16
  Require ip 10.0.0.0/8
  Require ip 172.16.0.0/12
</RequireAny>

# Geographic blocking (requires mod_geoip)
<IfModule mod_geoip.c>
  GeoIPEnable On
  SetEnvIf GEOIP_COUNTRY_CODE CN BlockCountry
  SetEnvIf GEOIP_COUNTRY_CODE RU BlockCountry

  Require all granted
  Require not env BlockCountry
</IfModule>

Complete Examples

WordPress Optimization

# BEGIN WordPress
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /
  RewriteRule ^index\.php$ - [L]
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule . /index.php [L]
</IfModule>
# END WordPress

# Security headers
<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set X-XSS-Protection "1; mode=block"
  Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Protect wp-config.php
<Files wp-config.php>
  Require all denied
</Files>

# Block access to sensitive files
<FilesMatch "(\.htaccess|\.htpasswd|readme\.html|license\.txt)">
  Require all denied
</FilesMatch>

# Disable XML-RPC if not needed
<Files xmlrpc.php>
  Require all denied
</Files>

# Browser caching
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType image/jpg "access plus 1 year"
  ExpiresByType image/jpeg "access plus 1 year"
  ExpiresByType image/gif "access plus 1 year"
  ExpiresByType image/png "access plus 1 year"
  ExpiresByType text/css "access plus 1 month"
  ExpiresByType application/pdf "access plus 1 month"
  ExpiresByType text/javascript "access plus 1 month"
  ExpiresByType application/javascript "access plus 1 month"
  ExpiresByType application/x-shockwave-flash "access plus 1 month"
  ExpiresByType image/x-icon "access plus 1 year"
  ExpiresDefault "access plus 2 days"
</IfModule>

# Compression
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/plain
  AddOutputFilterByType DEFLATE text/html
  AddOutputFilterByType DEFLATE text/xml
  AddOutputFilterByType DEFLATE text/css
  AddOutputFilterByType DEFLATE application/xml
  AddOutputFilterByType DEFLATE application/xhtml+xml
  AddOutputFilterByType DEFLATE application/rss+xml
  AddOutputFilterByType DEFLATE application/javascript
  AddOutputFilterByType DEFLATE application/x-javascript
</IfModule>

Single Page Application (SPA)

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Force HTTPS
  RewriteCond %{HTTPS} !=on
  RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

  # API routing
  RewriteRule ^api/(.*)$ /api/index.php?route=$1 [L,QSA]

  # SPA routing - send all non-file requests to index.html
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule ^(.*)$ /index.html [L]
</IfModule>

# Security headers
<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "DENY"
  Header set X-XSS-Protection "1; mode=block"
  Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'"
</IfModule>

# Caching
<IfModule mod_expires.c>
  ExpiresActive On

  # No cache for index.html
  <FilesMatch "index\.html$">
    ExpiresDefault "access plus 0 seconds"
    Header set Cache-Control "no-cache, no-store, must-revalidate"
  </FilesMatch>

  # Cache static assets
  ExpiresByType application/javascript "access plus 1 year"
  ExpiresByType text/css "access plus 1 year"
  ExpiresByType image/jpeg "access plus 1 year"
  ExpiresByType image/png "access plus 1 year"
  ExpiresByType image/svg+xml "access plus 1 year"
  ExpiresByType font/woff2 "access plus 1 year"
</IfModule>

# Compression
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css
  AddOutputFilterByType DEFLATE application/javascript application/json
</IfModule>

Best Practices

# Complete production-ready .htaccess example

# =====================================
# SECURITY
# =====================================

# Disable directory browsing
Options -Indexes

# Hide server signature
ServerSignature Off

# Protect sensitive files
<FilesMatch "(^#.*#|\.(bak|backup|conf|dist|fla|in[ci]|log|orig|psd|sh|sql|sw[op])|~)$">
  Require all denied
</FilesMatch>

# Block access to hidden files
<FilesMatch "^\.">
  Require all denied
</FilesMatch>

# Security headers
<IfModule mod_headers.c>
  Header set X-Content-Type-Options "nosniff"
  Header set X-Frame-Options "SAMEORIGIN"
  Header set X-XSS-Protection "1; mode=block"
  Header set Referrer-Policy "strict-origin-when-cross-origin"
  Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  Header always unset X-Powered-By
  Header unset X-Powered-By
</IfModule>

# =====================================
# PERFORMANCE
# =====================================

# Enable compression
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript
  AddOutputFilterByType DEFLATE application/javascript application/json application/xml
</IfModule>

# Browser caching
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresDefault "access plus 1 month"
  ExpiresByType text/html "access plus 0 seconds"
  ExpiresByType text/css "access plus 1 year"
  ExpiresByType application/javascript "access plus 1 year"
  ExpiresByType image/jpeg "access plus 1 year"
  ExpiresByType image/png "access plus 1 year"
  ExpiresByType image/svg+xml "access plus 1 year"
</IfModule>

# =====================================
# URL REWRITING
# =====================================

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Force HTTPS
  RewriteCond %{HTTPS} !=on
  RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

  # Remove trailing slash
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_URI} (.+)/$
  RewriteRule ^ %1 [R=301,L]

  # Clean URLs
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule ^(.*)$ index.php?route=$1 [L,QSA]
</IfModule>

# =====================================
# ERROR PAGES
# =====================================

ErrorDocument 400 /errors/400.html
ErrorDocument 401 /errors/401.html
ErrorDocument 403 /errors/403.html
ErrorDocument 404 /errors/404.html
ErrorDocument 500 /errors/500.html
ErrorDocument 503 /errors/503.html

# =====================================
# MIME TYPES
# =====================================

<IfModule mod_mime.c>
  # Web fonts
  AddType font/woff2 .woff2
  AddType font/woff .woff
  AddType font/ttf .ttf
  AddType font/otf .otf

  # Modern image formats
  AddType image/webp .webp
  AddType image/avif .avif

  # Other
  AddType application/json .json
  AddType application/manifest+json .webmanifest
</IfModule>

This comprehensive guide covers all essential .htaccess configuration patterns for modern web applications, from basic rewrites to advanced security and performance optimization.

htaccess-generator

Contentsdiscovered from source

commands ×1

Install