Back to tools

.htaccess Generator

Toggle the rule blocks you need — redirects, HTTPS, error pages, password protection, security hardening, caching — and compose them into one ordered .htaccess file. Every field renders as plain text, so nothing you type here ever executes.

Redirects

301 / 302 URL redirects

Send an old path to a new one. Runs before the front-controller catch-all, so PHP-app routing never swallows these.

Scheme & host

Force HTTPS & www canonicalisation

A site should answer at exactly one scheme and one host. Everything else should redirect there.

www ⇄ non-www

Errors

Custom error pages

Serve your own page instead of Apache's default when a request 404s, is forbidden, or the server chokes.

Access control

Password-protect a directory

Basic Auth via Apache itself — a login prompt in front of a folder, no application code involved.

Hardening

Security hardening

Small directives that close off common, genuinely-exploited misconfigurations.

Performance

Compression & browser caching

Two independent wins: smaller responses over the wire, and returning visitors skipping the request entirely.

Bandwidth

Hotlink protection

Stop other sites embedding your images directly and burning your bandwidth, by checking the Referer header.

PHP apps

Front-controller rewrite

Routes every request that isn't a real file or folder to one PHP file, so the app's own router decides what to do with it.

Composed file

.htaccess

Rewrite rules run top to bottom inside one engine block, in this order:

  1. Force HTTPS

Composed .htaccess

# .htaccess — composed with Wespner's .htaccess Generator
# Review before deploying: https://wespner.eu/tools

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Force HTTPS
    RewriteCond %{HTTPS} off
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</IfModule>

# Custom error pages
ErrorDocument 404 /errors/404.html

# Block access to dotfiles (.git, .env, .htpasswd, ...)
<IfModule mod_authz_core.c>
    <FilesMatch "^\.">
        Require all denied
    </FilesMatch>
</IfModule>

# Disable directory listing
Options -Indexes

# Disable the Apache version banner on error pages
ServerSignature Off

On nginx? .htaccess does nothing.

It's an Apache-only mechanism, and even on Apache it's commonly disabled (AllowOverride None) because checking for it on every request is slow. Nginx needs the equivalent rules written directly into a server block instead. Convert these to an Nginx config

Running your own game server?

Wespner game servers with DDoS protection, NVMe drives and activation within minutes.

Browse hosting