Apache .htaccess Generator

Canonical host

Force HTTPS and pick www or apex

No custom redirects yet. Click Add redirect to insert one.

Security headers

Sensible defaults via mod_headers

Compression and caching

gzip, Brotli, and browser cache lifetimes

Access controls

Directory listing, dotfiles, basic auth, hotlinks

Block by IP or user agent

Deny abusive crawlers and bad actors

Custom error pages

ErrorDocument for the common HTTP errors

• 400
• 401
• 403
• 404
• 500

Path is relative to the document root. Apache serves the file when a matching error occurs.

Misc

Tweaks

# .htaccess
# Generated by Zero Signup Tools Apache .htaccess Generator
# Place this file in the document root.
# Run `apachectl configtest` and reload Apache after changes.

# ---------------------------------------------------------------------------
# Options
# ---------------------------------------------------------------------------

Options +FollowSymLinks
Options -Indexes
ServerSignature Off
AddDefaultCharset UTF-8

# ---------------------------------------------------------------------------
# URL rewrites and redirects (mod_rewrite)
# ---------------------------------------------------------------------------

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Always allow ACME challenges (Let's Encrypt, ZeroSSL) to pass.
    RewriteRule ^\.well-known/acme-challenge/ - [L]

    # Force HTTPS on every request.
    RewriteCond %{HTTPS} !=on
    RewriteCond %{HTTP:X-Forwarded-Proto} !https
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

</IfModule>

# ---------------------------------------------------------------------------
# Security headers (mod_headers)
# ---------------------------------------------------------------------------

<IfModule mod_headers.c>
    # Block MIME sniffing. Browsers must respect the Content-Type sent.
    Header always set X-Content-Type-Options "nosniff"

    # Prevent the site from being framed except by the same origin.
    Header always set X-Frame-Options "SAMEORIGIN"

    # Tighten the Referer policy.
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    # Disable powerful browser features by default.
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=()"

    # Cross-origin isolation.
    Header always set Cross-Origin-Opener-Policy "same-origin"
    Header always set Cross-Origin-Resource-Policy "same-site"

    # Strict-Transport-Security pins the site to HTTPS for 365 days.
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

    # Remove Apache's stock Server detail header.
    Header unset X-Powered-By

</IfModule>

# ---------------------------------------------------------------------------
# Compression
# ---------------------------------------------------------------------------

<IfModule mod_deflate.c>
    # gzip the text MIME types.
    AddOutputFilterByType DEFLATE text/plain
    AddOutputFilterByType DEFLATE text/html
    AddOutputFilterByType DEFLATE text/xml
    AddOutputFilterByType DEFLATE text/css
    AddOutputFilterByType DEFLATE text/javascript
    AddOutputFilterByType DEFLATE application/xml
    AddOutputFilterByType DEFLATE application/xhtml+xml
    AddOutputFilterByType DEFLATE application/rss+xml
    AddOutputFilterByType DEFLATE application/javascript
    AddOutputFilterByType DEFLATE application/x-javascript
    AddOutputFilterByType DEFLATE application/json
    AddOutputFilterByType DEFLATE application/ld+json
    AddOutputFilterByType DEFLATE image/svg+xml
    AddOutputFilterByType DEFLATE font/ttf
    AddOutputFilterByType DEFLATE font/otf
</IfModule>

<IfModule mod_brotli.c>
    # Brotli for browsers that prefer it (most modern browsers).
    AddOutputFilterByType BROTLI_COMPRESS text/html
    AddOutputFilterByType BROTLI_COMPRESS text/plain
    AddOutputFilterByType BROTLI_COMPRESS text/css
    AddOutputFilterByType BROTLI_COMPRESS text/javascript
    AddOutputFilterByType BROTLI_COMPRESS application/javascript
    AddOutputFilterByType BROTLI_COMPRESS application/json
    AddOutputFilterByType BROTLI_COMPRESS application/xml
    AddOutputFilterByType BROTLI_COMPRESS image/svg+xml
</IfModule>

# ---------------------------------------------------------------------------
# Browser caching (mod_expires)
# ---------------------------------------------------------------------------

<IfModule mod_expires.c>
    ExpiresActive On

    # HTML: short cache so deploys take effect quickly.
    ExpiresByType text/html "access plus 60 minutes"

    # CSS and JS: medium cache. Pair with hashed filenames for safe long cache.
    ExpiresByType text/css "access plus 30 days"
    ExpiresByType application/javascript "access plus 30 days"
    ExpiresByType text/javascript "access plus 30 days"

    # Images: long cache. Replace via filename hash on update.
    ExpiresByType image/png "access plus 12 months"
    ExpiresByType image/jpg "access plus 12 months"
    ExpiresByType image/jpeg "access plus 12 months"
    ExpiresByType image/gif "access plus 12 months"
    ExpiresByType image/webp "access plus 12 months"
    ExpiresByType image/avif "access plus 12 months"
    ExpiresByType image/svg+xml "access plus 12 months"
    ExpiresByType image/x-icon "access plus 12 months"

    # Fonts: long cache.
    ExpiresByType font/woff "access plus 12 months"
    ExpiresByType font/woff2 "access plus 12 months"
    ExpiresByType font/ttf "access plus 12 months"
    ExpiresByType font/otf "access plus 12 months"
    ExpiresByType application/font-woff "access plus 12 months"
    ExpiresByType application/font-woff2 "access plus 12 months"

    # Manifests and feeds.
    ExpiresByType application/json "access plus 0 seconds"
    ExpiresByType application/ld+json "access plus 0 seconds"
    ExpiresByType application/manifest+json "access plus 1 week"
    ExpiresByType application/rss+xml "access plus 1 hour"
    ExpiresByType application/atom+xml "access plus 1 hour"
</IfModule>

<IfModule mod_headers.c>
    # Tell intermediaries the cache is fresh. Append immutable for hashed assets.
    <FilesMatch "\.(?:css|js|svg|woff2?|ttf|otf|eot|png|jpe?g|gif|webp|avif|ico)$">
        Header set Cache-Control "public, max-age=2592000"
    </FilesMatch>
</IfModule>

# ---------------------------------------------------------------------------
# Block dotfiles (.git, .env, .htpasswd, .DS_Store)
# ---------------------------------------------------------------------------

<FilesMatch "^\.(?!well-known)">
    Require all denied
</FilesMatch>

# ---------------------------------------------------------------------------
# Block leaked backup, swap, and editor files
# ---------------------------------------------------------------------------

<FilesMatch "\.(bak|backup|swp|swo|old|orig|save|tmp|temp|log|sql|sqlite|db)$">
    Require all denied
</FilesMatch>

# ---------------------------------------------------------------------------
# Custom error pages
# ---------------------------------------------------------------------------

ErrorDocument 404 /errors/404.html
ErrorDocument 500 /errors/500.html

Review

Looks good

Standard hardening, modern caching, force HTTPS, and dotfile denial are all in place. Ready to commit.

Reload Apache

Quick commands