.htaccess generator

Before you paste anything

The file only works on Apache and on LiteSpeed, which reads it for compatibility. Nginx ignores it entirely — the equivalent configuration lives in your server block and needs a reload to take effect.

Order matters

Rewrite rules run top to bottom, and each one can change the URL the next one sees. The output above is ordered deliberately:

1. HTTPS first, so every later redirect lands on a secure URL.
2. Then the www decision, so the host is settled before paths are touched.
3. Then extension and trailing-slash rules, which only concern the path.
4. Then your custom redirects.
5. Fallback routing last, because it matches anything left over.

Get this wrong and you get redirect chains — http://www.example.com/page.html bouncing through four hops before it lands. Each hop costs a round trip and dilutes link equity slightly. The ordering above collapses that to one or two.

Trailing slashes: pick one and commit

To a server, /about and /about/ are different URLs. If both return 200, you have duplicate content on every page of the site.

Which one you choose does not matter. That you choose does. The convention: directories get a trailing slash, files do not. If your pages are about/index.html then the slash is natural and Add is correct. If they are flat about.html files served through a rewrite, either works.

Whatever you pick, make your canonical tags, internal links and sitemap all agree with it. A canonical pointing at the non-slash version while the server redirects to the slash version is a contradiction Google will resolve however it likes.

The performance sections

Compression is the biggest single win in this file. Gzip cuts HTML, CSS and JavaScript by roughly 80 percent. Brotli does slightly better where it is available. Never compress images or video — they are already compressed, and re-compressing just burns CPU.

Caching tells browsers to keep static files rather than re-request them. A year for assets, an hour for HTML. This only works if your asset filenames change when the content does — otherwise visitors keep a stale stylesheet for a year. Most build tools add a content hash for exactly this reason. If yours does not, drop the asset cache to a week.

HSTS deserves its own warning

HSTS tells browsers to refuse HTTP for your domain for a fixed period. It is genuinely good for security and genuinely hard to undo — a browser that has seen the header will not connect over HTTP until the max-age expires, no matter what you change on the server.

Only enable it once HTTPS works on every subdomain, every asset and every redirect, and start with a short max-age such as 300 before raising it to a year. Do not add preload unless you have read what removal from the preload list involves.

Testing

Upload, then load the site immediately. If you get a 500, restore your backup — the error log will name the offending line.

Then check the redirects actually behave. curl -IL http://www.example.com/page.html shows every hop and status code in the chain. You are looking for a single 301 to the final URL, then a 200. Two 301s in a row is a chain worth flattening; a 302 where you expected a 301 means the rule is missing its R=301 flag.

$ curl -sIL http://www.example.com/page.html | grep -E "HTTP|location"
HTTP/1.1 301 Moved Permanently
location: https://example.com/page.html
HTTP/2 301
location: https://example.com/page/
HTTP/2 200

That example has one hop more than it needs. Combining the HTTPS and www rules into a single redirect is the fix, and it is what the generated file does when you enable both.

Questions about this generator

Related tools

Learn the why, not just the how

Longer reading on formatting, indentation and minification.