What is .htaccess used for?

.htaccess is a directory-level configuration file for Apache web servers. It lets you control redirects, URL rewriting, authentication, compression, caching, and security rules without needing access to the main Apache configuration. It is the primary way to configure behaviour on shared hosting where you do not have root access.

Does .htaccess work with Nginx?

No. .htaccess is an Apache-specific feature. Nginx does not read .htaccess files at all — Nginx configuration is done in server block config files, typically in /etc/nginx/sites-available/. If your hosting uses Nginx, you need to add equivalent rules to the server config directly.

Does .htaccess slow down my site?

Yes, slightly. Apache reads and parses .htaccess on every request for every directory in the path, even if the rules don't apply. For high-traffic sites, it is better to put the same rules directly in the main Apache VirtualHost config (where AllowOverride is set to None). For shared hosting where you have no access to the main config, .htaccess is your only option.

How do I force HTTPS with .htaccess?

Add these lines to your .htaccess: RewriteEngine On, RewriteCond %{HTTPS} off, RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]. Make sure your SSL certificate is installed first, or you will create a redirect loop.

.htaccess Generator

Toggle the rules you need. Get a complete, production-ready .htaccess file for your shared hosting — copy and paste into your site root.

Quick start

Force HTTPS

Redirect all HTTP traffic to HTTPS (requires SSL certificate installed)

Redirect www → non-www

Canonical non-www version — better for SEO

Enable GZIP compression

Compress HTML, CSS, JS before sending — reduces page size 60–80%

Browser caching headers

Tell browsers to cache static assets — speeds up repeat visits

Security headers

X-Frame-Options, X-Content-Type-Options, Referrer-Policy

Prevent directory listing

Hides file list when no index file exists

Block .env and dot-files

Deny access to .env, .git, and other hidden files

Block common bad bots

Deny known scrapers: SemrushBot, AhrefsBot, MJ12bot

Custom error pages

404 and 500 error pages

PHP settings overrides

upload_max_filesize, memory_limit, max_execution_time

WordPress URL rewriting

Required for WordPress permalinks to work

Laravel URL rewriting

Required for Laravel routing via index.php

.htaccess

Pro tips

What every shared hosting tutorial forgets to mention.

💾 Always backup before editing

A single syntax error in .htaccess causes a 500 Internal Server Error for your entire site. Before making any changes, download a copy of the existing file. If you break it, you can restore via FTP or cPanel File Manager.

🔁 Rule order matters — a lot

Apache processes .htaccess rules from top to bottom and stops at the first match (if [L] flag is used). HTTPS redirect must come before www redirect. WordPress/Laravel rewrite rules must come after security rules. The generator outputs rules in the correct order.

⚡ .htaccess has a performance cost

Apache reads .htaccess on every request for every directory in the path. On a high-traffic site with deeply nested directories, this adds up. If you have access to the main VirtualHost config, put rules there with AllowOverride None and remove .htaccess entirely.

🏗 mod_rewrite must be enabled

URL rewriting (WordPress permalinks, Laravel routing) requires mod_rewrite to be enabled. On most shared hosts it's on by default. If rewriting isn't working, contact your host to confirm it's enabled.

🔒 Protect .htaccess itself

Add <Files .htaccess> Require all denied </Files> to prevent anyone from viewing your .htaccess rules directly via the browser — especially important if you have passwords or IP rules.

🧪 Test with cURL before assuming it works

Don\'t rely on your browser to test redirects — browsers cache 301s aggressively. Use curl -I http://yoursite.com to see the actual HTTP response headers, including the redirect location.

On shared hosting and hitting its limits?

.htaccess exists because shared hosting doesn't give you server config access. A VPS does.

Compare shared hosts →