Free tool

.htaccess Generator & htpasswd Generator

Use the .htaccess generator to create a ready-to-use .htaccess file online from modules for 301 redirects, HTTPS, password protection, caching and compression, plus a .htpasswd file with a bcrypt hash. For example.com, it can generate 301 rules that redirect www.example.com and http to https://example.com. Free, with no sign-up, right in your browser.

Built by Dimitri Heissler

Building something of your own? Host it on a VPS with full control.

Rent your own VPS

Your domain (without www)

Optional. Only needed for the www rule and hotlink protection. It then applies only to this domain.

Quick start

The finished file appears below the building blocks. Go directly to output

Your files

5 blocks active

# .htaccess generated with the ZAP-Hosting .htaccess Generator
# Before uploading: create a backup copy and test it in a staging environment first.

# HTTPS and domain format
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# General and Security
Options -Indexes
AddDefaultCharset UTF-8
ServerSignature Off
<IfModule mod_headers.c>
  Header always unset X-Powered-By
  Header unset X-Powered-By
</IfModule>
RewriteCond %{REQUEST_URI} !(^|/)\.well-known/ [NC]
RewriteRule (^|/)\. - [F]
<FilesMatch "\.(bak|sql|log|ini|swp|dist|orig|old|conf)$|~$">
  Require all denied
</FilesMatch>

# Security headers
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>

# Compression
<IfModule mod_brotli.c>
  AddOutputFilterByType BROTLI_COMPRESS text/html text/plain text/css text/xml text/javascript application/javascript application/json application/ld+json application/xml application/xhtml+xml application/rss+xml application/atom+xml image/svg+xml image/x-icon font/ttf font/otf application/vnd.ms-fontobject
</IfModule>

<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/css text/xml text/javascript application/javascript application/json application/ld+json application/xml application/xhtml+xml application/rss+xml application/atom+xml image/svg+xml image/x-icon font/ttf font/otf application/vnd.ms-fontobject
</IfModule>

# Browser caching
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType image/jpeg "access plus 1 month"
  ExpiresByType image/png "access plus 1 month"
  ExpiresByType image/gif "access plus 1 month"
  ExpiresByType image/webp "access plus 1 month"
  ExpiresByType image/avif "access plus 1 month"
  ExpiresByType image/svg+xml "access plus 1 month"
  ExpiresByType image/x-icon "access plus 1 month"
  ExpiresByType text/css "access plus 1 week"
  ExpiresByType text/javascript "access plus 1 week"
  ExpiresByType application/javascript "access plus 1 week"
  ExpiresByType font/woff "access plus 1 year"
  ExpiresByType font/woff2 "access plus 1 year"
  ExpiresByType font/ttf "access plus 1 year"
  ExpiresByType font/otf "access plus 1 year"
  ExpiresByType application/vnd.ms-fontobject "access plus 1 year"
  ExpiresByType video/mp4 "access plus 1 month"
  ExpiresByType video/webm "access plus 1 month"
  ExpiresByType audio/mpeg "access plus 1 month"
  ExpiresByType audio/ogg "access plus 1 month"
  ExpiresByType text/html "access plus 0 seconds"
  ExpiresByType application/xhtml+xml "access plus 0 seconds"
</IfModule>

64 lines

Some browsers remove the leading dot or append .txt. Rename the downloaded file to .htaccess before uploading it.

What you should check

If your site runs behind Cloudflare, a load balancer, or a reverse proxy, Apache often sees only HTTP and redirects endlessly (ERR_TOO_MANY_REDIRECTS error). In that case, enable “Behind a proxy”.

Before uploading

Back up the existing .htaccess file, if there is one.
Test the file on a staging site first, not the live site.
Place it in your domain's root directory (usually public_html or htdocs). Its name begins with a dot.
If the page then shows a 500 error, rename the file via FTP and check your server's error log.

Example result

What this .htaccess Generator gives you

Enable the options you need to get a ready-to-use .htaccess file to copy or download. Password protection also generates a .htpasswd with a bcrypt hash, and PHP settings generate a .user.ini. Risky settings trigger an immediate warning. Three examples:

Example 1: New website on example.com

Input:

Domain: example.com
Enforce HTTPS and always use the address without www
GZIP compression on
Caching: images for 1 month, CSS and JavaScript for 1 week, always revalidate HTML
Disable directory listings

Output (.htaccess):

# .htaccess generated with the ZAP-Hosting .htaccess Generator
# Before uploading: create a backup copy and test it in a staging environment first.

# HTTPS and domain format
RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.example\.com$ [NC]
RewriteRule ^ https://example.com%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# General and Security
Options -Indexes

# Compression
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/css text/xml text/javascript application/javascript application/json application/ld+json application/xml application/xhtml+xml application/rss+xml application/atom+xml image/svg+xml image/x-icon font/ttf font/otf application/vnd.ms-fontobject
</IfModule>

# Browser caching
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType image/jpeg "access plus 1 month"
  ExpiresByType image/png "access plus 1 month"
  ExpiresByType image/gif "access plus 1 month"
  ExpiresByType image/webp "access plus 1 month"
  ExpiresByType image/avif "access plus 1 month"
  ExpiresByType image/svg+xml "access plus 1 month"
  ExpiresByType image/x-icon "access plus 1 month"
  ExpiresByType text/css "access plus 1 week"
  ExpiresByType text/javascript "access plus 1 week"
  ExpiresByType application/javascript "access plus 1 week"
  ExpiresByType text/html "access plus 0 seconds"
  ExpiresByType application/xhtml+xml "access plus 0 seconds"
</IfModule>

In words: An address such as http://www.example.com/seite is redirected with a single 301 to https://example.com/seite. Requests using http:// without www are also redirected to https:// with a 301. Images stay in the browser cache for 1 month (max-age=2592000), CSS and JavaScript for 1 week, while HTML pages are checked again on every visit. HTML, CSS, JavaScript, and JSON are transferred with GZIP compression. Anyone opening a directory without an index file now sees a 403 error instead of a file listing.

Example 2: Password-protected staging site

Input:

Password prompt text: Staging
Path to .htpasswd: /home/example/.htpasswd
User alice with password Sommer-2026!
Block search engines

Output (.htaccess):

# .htaccess generated with the ZAP-Hosting .htaccess Generator
# Before uploading: create a backup copy and test it in a staging environment first.

# Password protection
AuthType Basic
AuthName "Staging"
AuthUserFile /home/example/.htpasswd
Require valid-user

<IfModule mod_headers.c>
  Header always set X-Robots-Tag "noindex, nofollow"
</IfModule>

Output (.htpasswd):

alice:$2y$10$EixZaYVK1fsbw1ZfbX3OXevuQZIxS3zUD8zrCJEoRasNwfjhtG6f.

In words: Visitors see a login prompt with the text “Staging”. Without a valid user, the server returns status 401. The .htpasswd file contains only the bcrypt hash: $2y$ indicates bcrypt, 10 is the cost factor, followed by the salt and hash. The password itself is not stored anywhere. Put the file at the path specified by AuthUserFile, preferably outside the web directory.

Example 3: Move one page, remove another

Input:

/old-page redirects to /new-page with a 301, including everything below it
/summer-sale is permanently gone (410), only for that exact path

Output (.htaccess):

# .htaccess generated with the ZAP-Hosting .htaccess Generator
# Before uploading: create a backup copy and test it in a staging environment first.

# Custom redirects
Redirect 301 /old-page /new-page
RedirectMatch 410 "^/summer-sale/?$"

In words: /old-page and /old-page/info are redirected with a 301 to /new-page and /new-page/info, so subpages are preserved. /summer-sale returns status 410 (Gone) so search engines remove the page from their indexes faster. An address such as /old-pages is unaffected because the rule only matches at path boundaries. The tool also warns that browsers remember a 301 permanently, so you should test new rules with a 302 first.

How it works

How to create a .htaccess file

Four steps from selection to a tested file—no account or installation needed.

Step 1

Select building blocks

Enter your domain above and enable the modules you need, or start with a template: “Good defaults”, “Secure staging” or “Move domain”. Each module briefly explains what it does.

Step 2

Set options

Configure redirects using 301, 302, 307, 308 or 410, users, error pages or cache durations. The tool warns you about risky settings such as redirect loops, password protection without HTTPS or excessively long cache durations.

Step 3

Copy or download file

The output updates whenever you make a change. Copy or download the .htaccess file. Password protection also generates a .htpasswd file with the bcrypt hash; PHP settings generate a .user.ini file.

Step 4

Upload and test

Back up the existing file, place the new one in your domain’s root directory and open the page. Test redirects with 302 first, then with 301.

htpasswd Generator

htpasswd Generator: Create .htpasswd with a bcrypt hash

For .htaccess password protection, you need a .htpasswd file alongside .htaccess. Each line contains a user and their hashed password. The generator above creates the line in the “Password protection” section. Your browser calculates the hash; the password is never sent anywhere.

Structure of a .htpasswd file

One line per user in the format username:hash. Example for the user and password from the example above:

alice:$2y$10$EixZaYVK1fsbw1ZfbX3OXevuQZIxS3zUD8zrCJEoRasNwfjhtG6f.

Which hash is secure?

bcrypt, identifiable by $2y$, is the recommended hash and is supported by Apache 2.4. Older formats such as MD5 ($apr1$), SHA-1, and crypt are weaker and can be cracked faster. The generator therefore creates bcrypt hashes.

Alternative on the server

With shell access, you can create the same file using htpasswd. The -B option uses bcrypt; -c creates a new file:

htpasswd -cB .htpasswd benutzername

Common tasks

.htaccess redirects, HTTPS, password protection and WordPress: rules ready to copy

The four most common reasons to use a .htaccess file, with ready-made rules. Adjust the paths and domain, or let the generator above create them.

.htaccess redirect (301)

A 301 redirect permanently redirects a page and everything beneath it. /alte-seite/info becomes /neue-seite/info. Put the rule in the .htaccess file in the domain's root directory.

Redirect 301 /alte-seite /neue-seite

Force HTTPS with .htaccess

Redirect every http request to https with a 301 redirect. If the site is behind Cloudflare or a proxy, you also need to check the X-Forwarded-Proto header to avoid a redirect loop.

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

.htaccess password protection

Prompts for a username and password to access the directory. AuthUserFile specifies the full server path to .htpasswd, preferably outside the web directory.

AuthType Basic
AuthName "Protected area"
AuthUserFile /pfad/zur/.htpasswd
Require valid-user

.htaccess for WordPress

This is the default block created by WordPress. Do not change it. Put your own rules, such as redirects or HTTPS, before it; otherwise, they will not take effect.

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

Overview

The Apache directives behind these building blocks

Each building block writes a few clearly named directives to the file. The table shows which ones and which Apache module handles them. If an optional module is missing, Apache ignores the block instead of displaying an error.

Building blocks, Apache directives, and responsible modules
Building block	Directives	Apache module
HTTPS and www	RewriteCond, RewriteRule [R=301]	mod_rewrite
Redirects	Redirect, RedirectMatch, RewriteRule	mod_alias, mod_rewrite
Password protection	AuthType Basic, AuthName, AuthUserFile, Require valid-user	mod_auth_basic, mod_authn_file, mod_authz_user
IP access	Require ip, Require not ip, RequireAny, RequireAll	mod_authz_host, mod_authz_core
Error pages	ErrorDocument	core
Browser caching	ExpiresActive, ExpiresByType	mod_expires
Compression	AddOutputFilterByType DEFLATE, BROTLI_COMPRESS	mod_deflate, mod_brotli
Hotlink protection	RewriteCond %{HTTP_REFERER}, RewriteRule [F]	mod_rewrite
Security	Options -Indexes, FilesMatch, ServerSignature Off	core, mod_authz_core
Security headers	Header always set	mod_headers
PHP values	php_value, .user.ini	mod_php

Discover more

More tools

Redirect Checker

Check a URL’s redirect chain hop by hop: status codes (301/302/307/308), HTTP headers, server IP, and response time for each redirect.

Built by Luca Stanek

Robots.txt Generator

Create robots.txt using a rule editor or per-bot settings, including GPTBot, Google-Extended, and more.

Built by Rugile Rutkauskaite

CHMOD Calculator

Build Unix/Linux file permissions using checkboxes to get an octal value and symbolic notation, or decode them in reverse — including setuid/setgid/the sticky bit and a ready-to-copy chmod command.

Built by Justin Schuessler

Bcrypt Generator & Checker

Generate and verify Bcrypt hashes—entirely in your browser, with an adjustable cost factor.

Built by Rugile Rutkauskaite

Password Generator

Generate strong, random passwords directly in your browser — nothing is stored or transmitted.

Built by Rugile Rutkauskaite

URL Encoder & Decoder

Encode and decode URLs and text online: compare encodeURIComponent, encodeURI, and form encoding, with a query parameter table and UTM link builder. Runs entirely in your browser.

Built by Dimitri Heissler

FAQ

Frequently asked questions about .htaccess generator

Quick answers about .htaccess, redirects, password protection, and this tool.

A .htaccess file configures the Apache web server on a per-directory basis. It lets you control redirects, password protection, error pages, caching, compression and access rules without changing the server configuration. This is especially useful on shared hosting. Apache and LiteSpeed Web Server read the file; nginx ignores it. For nginx, put the rules in server or location blocks in its configuration. Apache rereads .htaccess on every request. On your own server, such as a VPS, it is therefore better to put the same rules directly in the virtual host configuration.

The file must be named exactly .htaccess, with a leading dot and no extension. Place it in your domain's root directory, usually public_html, htdocs, or httpdocs. Its rules apply to the folder containing the file and all subfolders. Because dotfiles are considered hidden, your FTP program may not show them. Enable the display of hidden files there.

The simplest way is the line Redirect 301 /alte-seite /neue-seite. It redirects the path and everything beneath it, so /alte-seite/info becomes /neue-seite/info. To redirect only an exact path, use RedirectMatch 301 with a regular expression. The destination can also be a full URL such as https://beispiel.de/seite. The generator creates both types for you and warns you about redirect loops. Alongside 301 (permanent), it offers 302 (temporary), 307, 308 and 410 for removed pages. Test new rules with 302 first, because browsers cache 301 redirects permanently.

Enable the rewrite engine, use RewriteCond to check whether HTTPS is off, and use RewriteRule to redirect to the https address with a 301. The “HTTPS and www” option generates the complete block. If your site runs behind Cloudflare, a load balancer, or a reverse proxy, Apache often sees only HTTP and redirects endlessly, causing ERR_TOO_MANY_REDIRECTS in the browser. In that case, enable “Behind a proxy” to check the X-Forwarded-Proto header too.

You need two files: .htaccess with AuthType Basic, AuthName, AuthUserFile and Require valid-user, and .htpasswd with one line per user in name:hash format. The generator creates both. Your password is hashed with bcrypt in your browser, identifiable by $2y$ at the start of the hash. MD5 ($apr1$), SHA-1 and crypt are weaker. Place .htpasswd outside the web directory and enable HTTPS, because Basic Auth sends credentials with every request. If you combine password protection with the “IP access” module, choose “IP or password” or “IP and password”; the generator builds the appropriate Require block.

A 500 error almost always means Apache cannot understand a line. Common causes include a typo, a directive whose module is missing from the server, or a setting your host does not allow in .htaccess, such as Options or php_value. Rename the file via FTP to get the site working again. The server error log gives the exact error. The generator’s caching, compression, header and PHP blocks are guarded with IfModule, so missing modules will not cause a 500 error. php_value works only when PHP runs as an Apache module. For PHP-FPM, the generator also provides the PHP settings in a .user.ini file.

WordPress creates its own block between # BEGIN WordPress and # END WordPress. Leave it unchanged (it's included in the section above for copying). Add the rules generated by the tool before it. Redirects and HTTPS rules must come before the WordPress block, or they won't work because WordPress sends all requests to index.php. WordPress needs the rewrite engine for permalinks, so don't disable it.

No. The generator runs entirely in your browser: your inputs are not sent to a server or saved. The bcrypt hash is also generated locally. Only the names of enabled modules appear in the URL, never domains, paths, IP addresses or passwords.

Any more questions?

Contact Support

Building something of your own?

With your own server, the rules are where they belong: in your configuration

On a ZAP-Hosting VPS, you control Apache or nginx yourself, without the limits of shared hosting.

4.4/5 Trustpilot32,000+ Active serversSince 2010

View hosting

No setup. No risk. Online in seconds.

Flexible TermCancel anytimeOnline in 60 seconds

Looking for more tools? View all developer tools

.htaccess Generator & htpasswd Generator

HTTPS and www

Redirects

Password protection

IP access

Error pages

Browser caching

Compression

Hotlink protection

Security

Security headers

PHP values

Your files

What you should check

What this .htaccess Generator gives you

Example 1: New website on example.com

Example 2: Password-protected staging site

Example 3: Move one page, remove another

How to create a .htaccess file

Select building blocks

Set options

Copy or download file

Upload and test

htpasswd Generator: Create .htpasswd with a bcrypt hash

Structure of a .htpasswd file

Which hash is secure?

Alternative on the server

.htaccess redirects, HTTPS, password protection and WordPress: rules ready to copy

.htaccess redirect (301)

Force HTTPS with .htaccess

.htaccess password protection

.htaccess for WordPress

The Apache directives behind these building blocks

More tools

Redirect Checker

Robots.txt Generator

CHMOD Calculator

Bcrypt Generator & Checker

Password Generator

URL Encoder & Decoder

Frequently asked questions about .htaccess generator

With your own server, the rules are where they belong: in your configuration

Game Server

Servers & Hosting

ZAPX

Resources

ZAP-Hosting