.htaccess Generator

What .htaccess is for, and when not to use it

An .htaccess file applies Apache configuration to the directory it sits in and everything below it. It exists for situations where you cannot edit the main server configuration, typically shared hosting. If you do have access to the vhost, put the directives there instead: Apache re-reads .htaccess on every single request and walks every parent directory looking for more, which is a measurable performance cost that vhost configuration does not carry.

Redirect status codes matter

A 301 is permanent and tells search engines to transfer the old URL's signals to the new one and update their index. A 302 is temporary and tells them to keep the original indexed. Using a 302 for a permanent move is one of the more common and more damaging SEO mistakes, because the new URL never accumulates the old one's authority. Use 301 for permanent moves and 302 only for genuinely temporary ones such as maintenance or A/B tests.

Pick one canonical host

A site reachable at both www and the bare domain, over both HTTP and HTTPS, has four URLs for every page. Redirect all of them to one canonical form in a single hop. Chained redirects, where HTTP goes to HTTPS and then non-www goes to www, waste crawl budget and add latency; combine the conditions into one rule that reaches the destination directly.

Rewrite rules are ordered and can loop

mod_rewrite processes rules top to bottom and, in a directory context, re-runs the whole set after a rewrite. Without a terminating condition a rule that rewrites into a path matching its own pattern loops until Apache stops it with a 500. Add RewriteCond %{REQUEST_FILENAME} !-f and !-d before a front-controller rule so real files and directories are served directly rather than rewritten.

Test before deploying

A syntax error in .htaccess takes the entire site down with a 500, immediately, for every visitor. There is no partial failure. Keep a known-good copy, change one thing at a time, and verify with curl -I that you get the status code you expect rather than trusting the browser, which caches 301s aggressively and will keep following a stale redirect long after you have fixed it.

Related tools

• CI/CD Security Gap Analyzer — Checklist based analyzer for CI/CD pipeline security gaps.
• Docker Security Scanner — A new tool extracted from the codebase.
• Terraform Scanner — A new tool extracted from the codebase.
• SQL Formatter — Format and indent SQL queries for readability. Handles joins, subqueries and CTEs, supports common dialects, and runs entirely in your browser.