Apache .htaccess Configuration

An .htaccess file lets you configure Apache per directory without touching the server config, which is why shared hosts rely on it. The same flexibility makes it easy to write a rule that silently does nothing or, worse, loops forever.

HTTPS redirects that do not loop behind a proxy

The usual test, RewriteCond %{HTTPS} off, is always true when a CDN or load balancer terminates TLS and forwards plain HTTP, so every request redirects to HTTPS again and the browser gives up. Also check the X-Forwarded-Proto header the proxy sets, and redirect only when it is not https.

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !=https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Wrapped blocks fail silently

A block inside IfModule mod_rewrite.c is skipped without any message when that module is not loaded. That keeps the site up, but it also means a redirect or compression rule can be missing without an error. After deploying, request the plain-HTTP URL and a page with Accept-Encoding: gzip and confirm both behave.

mod_deflate compresses only the types you name

Unlike Nginx, which always compresses HTML once gzip is on, Apache's AddOutputFilterByType compresses exactly the MIME types listed. Leave out text/html and your pages go out uncompressed while your CSS and JavaScript are compressed.

AddOutputFilterByType DEFLATE text/html text/plain text/css application/javascript application/json image/svg+xml

Permission errors and AllowOverride

A directive in .htaccess works only if the server's AllowOverride setting permits its group: FileInfo for rewrites, Options for Options -Indexes, AuthConfig for Require. A directive that is not permitted returns a 500 error, and the real reason is in the Apache error log.

Open the Apache .htaccess generator

Frequently asked questions

Is .htaccess slower than the main server config?

Slightly. Apache checks for an .htaccess file in every directory on the path to each request. If you control the server, put the same directives in the virtual host and set AllowOverride None.

Why do dotfiles return 404 and not 403?

A 404 does not confirm the file exists. The rule leaves /.well-known reachable, which certificate validation and security.txt need.

Does this work on Nginx?

No. Nginx ignores .htaccess files. Use the Nginx generators for the same protections.

Guides

• Nginx Reverse Proxy Configuration
• Caddy Reverse Proxy Configuration
• Nginx Static Site Configuration
• Caddy Static Site Configuration
• Nginx + PHP-FPM Configuration
• Caddy + PHP-FPM Configuration
• Nginx SSL/TLS Configuration
• Nginx Load Balancer Configuration
• Caddy Load Balancer Configuration
• Nginx Rate Limiting Configuration
• Nginx Security Headers Configuration
• Caddy Security Headers Configuration
• Nginx Gzip Compression Configuration
• Nginx Caching Configuration
• Caddy HTTPS Redirect Configuration
• Nginx WebSocket Proxy Configuration
• Nginx Content-Security-Policy Header
• Block Bad Bots and Scanners in Nginx
• fail2ban for Nginx
• nginx.conf Best Practices
• Nginx Location Regex Tester
• Deploy Nginx Config with GitHub Actions
• Nginx CORS Headers Configuration
• Nginx Cache-Control Headers Configuration
• Nginx 301 Redirect Map Configuration
• robots.txt, Sitemap and security.txt
• Apache .htaccess Configuration
• Docker Compose and Dockerfile Configuration
• systemd Service and Timer Configuration
• Cron Expression Explainer
• SSH Hardening with sshd_config
• Linux Firewall Rules: ufw, nftables and iptables
• Glob Pattern Tester
• Analysing Nginx Access Logs with awk