Create .htaccess

Apache uses this file to control redirects, encryption, compression and access. Build your configuration here rather than piecing it together from forum posts.

A rule file controls a forwarding, a protected area and the delivery of a website. — How it works
Compiling server rules appropriately
Selecting the necessary rules
Check the generated configuration
.htaccess and test it on the server

Domain

Your domain

With or without https:// and www. Everything after the domain is removed.

Without a domain, the www redirect and hotlink protection cannot be generated, so both sections are omitted below.

Redirects

One address per page: if the same page is available at multiple URLs, its search visibility is split between them.

www or without?

On example.deredirect wwwOn www.example.deredirect the bare domainLeave unchangedno rule for this

Always enforce HTTPSUnencrypted requests permanently redirect to https.

Moved URLs: one per line

Model: /alt /neu. The old URL starts with a slash; the destination may be a full URL. Lines starting with # are skipped.

Temporary

Turn on compressionCompress text before sending it, usually reducing data transfer by 60 to 80 per cent.Setting browser buffersReturning visitors do not need to reload images, fonts and styles.

Security

Turn off directory listsWithout a start file, Apache otherwise shows the contents of the folder.Blocking confidential filesBlocks .env, .git, backups and log files.Prevent image hotlinkingOther websites can no longer embed your images directly.

Start files (optional)

Leave empty to keep the server’s default setting.

Error pages

Use your own error pagesShow a page matching your website instead of the server’s default error message.

Result · 64 rows · 2.7 KB

# .htaccess
#
# Generated with Seitenicht.de. Applies to Apache from 2.4.
# Create a backup of the existing file before uploading.

# --- Redirects ---------------------------------------------------
<IfModule mod_rewrite.c>
  RewriteEngine On

  # Always deliver encrypted.
  # %{HTTPS} ist hinter einem Proxy oft leer – deshalb zusätzlich der
  # handed over headers, otherwise an endless loop is created.
  RewriteCond %{HTTPS} !=on
  RewriteCond %{HTTP:X-Forwarded-Proto} !=https
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

# --- Compression -------------------------------------------------
# Compress text before sending. the largest single win on load time,
# which a .htaccess can bring at all – often 60 to 80 percent less.
# Images are deliberately missing: JPG, PNG and WebP are already compressed.
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css
  AddOutputFilterByType DEFLATE application/javascript application/x-javascript text/javascript
  AddOutputFilterByType DEFLATE application/json application/xml application/rss+xml
  AddOutputFilterByType DEFLATE image/svg+xml font/woff2 font/ttf
</IfModule>

# --- Browser buffers ---------------------------------------------
# How long the browser can keep files without asking again.
# HTML deliberately short: Otherwise, returning visitors will see the old version for days.
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType text/html                 "access plus 10 minutes"
  ExpiresByType text/css                  "access plus 1 year"
  ExpiresByType application/javascript    "access plus 1 year"
  ExpiresByType image/jpeg                "access plus 1 year"
  ExpiresByType image/png                 "access plus 1 year"
  ExpiresByType image/webp                "access plus 1 year"
  ExpiresByType image/svg+xml             "access plus 1 year"
  ExpiresByType font/woff2                "access plus 1 year"
  ExpiresDefault                          "access plus 1 month"
</IfModule>

# One year only works if filenames change when changes occur
# (stil.a1b2c3.css).

# --- List of registers -------------------------------------------
# Do not display a table of contents without start file – otherwise everyone can see,
# which files are in a folder.
Options -Indexes

# --- Confidential files ------------------------------------------
# Configuration and version files are accessible via the browser if they
# in the web folder. .env often contains access data in plain text.
<FilesMatch "^\.|\.(env|ini|log|sh|sql|bak|old|swp|dist)$">
  Require all denied
</FilesMatch>

# The .htaccess itself as well.
<Files ".htaccess">
  Require all denied
</Files>

Before uploading

Back up the existing file. A typo in .htaccess can immediately bring the website down with a 500 error. A backup lets you restore it quickly.

Place the file in the website root, usually public_html or htdocs. Its name starts with a dot, so many file managers hide it by default.

For Apache only. nginx and Node.js servers ignore this file; they require equivalent settings in their server configuration.

Each section has a comment explaining its purpose. Understand the rules before uploading: an incorrect .htaccess can make your website inaccessible.

Two pitfalls

Year-long caching requires hashed filenames. If your file is always called stil.css, returning visitors may keep seeing the old version for a year. A changing filename such as a1b2c3.css solves this. When in doubt, reduce caching to a few hours.

With image protection, the empty condition remains. Some traffic doesn't even send a source -- email previews and some search engines, for example. Without this exception, your images stayed empty there too.

Then, if they follow you will see. Website check – he tracks the entire forwarding chain and reports detours.

Other tools

From ‘Source code and server” and related categories. Free, with no sign-up.

Create .htaccess

Compiling server rules appropriately

Domain

Redirects

Temporary

Security

Error pages

Before uploading

Two pitfalls

Other tools

Format HTML

Format CSS

Format JSON

Encode a URL

Create schema markup

Create UTM links