.htaccess Generator
Build a correct Apache .htaccess — security headers, redirects, access rules, caching — with a visual interface.
.htaccess, paste, and test — a wrong
directive can break a site or weaken its security.
Target server
Require all denied; 2.2 uses the deprecated Order/Deny. Do not mix them on one server.
Security
Security Headers
Redirects
Performance
Error Pages
Custom Rewrite Rules
Add your own RewriteRule directives (verified line by line; newlines are stripped).
Generated .htaccess
# Generated .htaccess
Presets
Common Directives Reference
Require all denied
Apache 2.4 deny-all (replaces Order/Deny)
<IfModule>
Only apply if a module is loaded
RewriteCond
Condition for the next rewrite rule
RewriteRule
URL pattern matching and rewriting
Options -Indexes
Disable directory browsing
Header always set
Add a response header (incl. on errors)
[L]
Last rule — stop processing
[R=301]
Permanent redirect
How to use
- Pick a preset (Security, Performance, WordPress, Laravel) or tick the options you need.
- Set the Apache version for your server — 2.4 is almost always correct.
- Watch the Generated .htaccess panel update as you change options.
- Back up your existing
.htaccess, then Copy or Download the result. - Paste it on your server, reload the site, and test key pages and redirects. Roll back the backup if anything breaks.
Every block carries a comment explaining what it does and its caveats, and is wrapped in
<IfModule> so a missing module is ignored instead of returning a 500 error.
Frequently asked questions
Does this generate Apache 2.4 or 2.2 syntax?
Apache 2.4 by default: access control uses Require all denied (mod_authz_core). If you are still on Apache 2.2 you can switch the "Apache version" selector to emit the legacy Order/Allow/Deny instead. Never mix the two styles on one server.
Will the HTTPS redirect loop behind a proxy or CDN?
No. The Force HTTPS rule also checks X-Forwarded-Proto, so when TLS is terminated by a proxy, CDN or load balancer in front of Apache it does not redirect in a loop. Uncheck "behind a proxy" only if Apache terminates TLS itself.
Why is the dotfile block a RewriteRule and not <FilesMatch "^\.">?
A bare <FilesMatch "^\."> only matches a filename that starts with a dot, so it does NOT protect /.git/config (the filename there is config). The mod_rewrite rule matches any path segment starting with a dot, so it covers files inside .git, .svn and similar, while leaving /.well-known reachable for TLS issuance and security.txt.
Is it safe to paste the output straight onto my server?
Review it first. The generator produces syntactically correct directives, but only you know your hosting (proxy, subdomains, existing rules). Back up any existing .htaccess, paste, and test. HSTS preload in particular is hard to undo — only enable it when every subdomain is HTTPS-ready.
Does anything I type leave my browser?
No. The whole tool runs client-side in JavaScript. Nothing you enter is sent to cyberramen.com or any third party.