consolelog.tools

htaccess Generator

Build a complete Apache .htaccess file visually — force HTTPS, canonicalise www, add 301/302 redirects and mod_rewrite rules, an SPA fallback, gzip compression, per-type browser caching, security headers, file/dotfile blocking, basic-auth, hotlink protection and IP rules. The file renders live into the conventional <IfModule> blocks, and an audit panel flags ordering mistakes, redirect loops, and broken backreferences before you deploy.

About this ToolHow it works, benefits & use cases

Hand-writing an Apache .htaccess is unforgiving: one stray RewriteRule flag, a rule in the wrong order, or an HSTS header without HTTPS forcing, and your site can stop loading or quietly mis-route traffic. This htaccess Generator models the whole file as a structured set of rules and emits clean, correct output that updates live as you edit. Toggle Force HTTPS for a 301 upgrade RewriteRule, pick a www mode to canonicalise to or away from the www subdomain, add custom 301/302 redirects and full mod_rewrite rules (pattern, substitution and flags), and drop in an SPA / front-controller fallback that routes any missing file to a single entry point. Layer on gzip compression (mod_deflate), per-file-type browser caching (mod_expires) with sensible far-future expiries, a full set of security headers (HSTS, X-Frame-Options, Referrer-Policy and more via mod_headers), dotfile and sensitive-file blocking, a basic-auth scaffold, hotlink protection, and Apache 2.4 IP allow/deny rules. Everything is grouped into the conventional <IfModule> guards so directives degrade gracefully when a module is missing, and a live audit panel flags ordering mistakes, redirect loops and broken backreferences before you ship. The entire configuration is encoded in the page URL, so a share link reproduces it exactly.

How to Use

  1. 1Start from a preset (WordPress, SPA, Force HTTPS + www, Static site + caching, Maintenance mode) or build from scratch.
  2. 2Toggle Force HTTPS and pick a www mode to canonicalise your domain; both emit correctly ordered 301 redirects.
  3. 3Add custom redirects (301/302) and mod_rewrite rules with pattern, target and flags, or enable the SPA fallback for client-side routers.
  4. 4Turn on gzip compression and browser caching, then choose which file types to cache; add security headers and file/IP access rules as needed.
  5. 5Watch the .htaccess render live into <IfModule> blocks, read the audit panel for problems, then copy or download the file to your site root.

Key Benefits

  • A real rule builder covering HTTPS, www, redirects, rewrites, SPA fallback, caching, headers and access control — not a fixed snippet
  • Output grouped into conventional <IfModule mod_rewrite/mod_deflate/mod_expires/mod_headers> guards so it degrades gracefully
  • Live preview regenerates the moment you change a rule — no separate generate step
  • A built-in audit flags redirect loops, HSTS without HTTPS, broken $1 backreferences, empty caching and lockout-prone IP rules
  • Correct, current Apache syntax: 301/302 redirects, RewriteCond/RewriteRule, ExpiresByType, Header set, FilesMatch and Apache 2.4 Require directives
  • Five presets for the common cases: WordPress, single-page apps, HTTPS canonicalisation, static-site performance, and maintenance mode
  • Shareable URL captures the whole configuration; runs entirely client-side so nothing leaves your browser

Common Use Cases

  • Forcing HTTPS and picking a single canonical host (www or apex) after installing an SSL certificate
  • Adding a history-API fallback so a React or Vue single-page app serves index.html on deep links
  • Setting far-future cache headers and gzip on a static or shared Apache host to cut load times
  • Hardening a site with security headers, dotfile blocking and sensitive-file rules (wp-config.php, .env)
  • Putting a site into maintenance mode that returns a 503 to everyone except an allow-listed IP

Apache config — drop in your site root

# .htaccess — generated by consolelog.tools
# Test in staging before deploying to production.

<IfModule mod_rewrite.c>
  RewriteEngine On

  # SPA / front-controller fallback
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule ^ index.html [L]
</IfModule>

# Directory options
Options -Indexes

# Gzip compression
<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css application/javascript application/json application/xml image/svg+xml font/ttf font/woff2
</IfModule>

# Browser caching
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType image/jpeg "access plus 1 year"
  ExpiresByType image/png "access plus 1 year"
  ExpiresByType image/gif "access plus 1 year"
  ExpiresByType image/webp "access plus 1 year"
  ExpiresByType image/avif "access plus 1 year"
  ExpiresByType image/svg+xml "access plus 1 year"
  ExpiresByType image/x-icon "access plus 1 year"
  ExpiresByType text/css "access plus 1 month"
  ExpiresByType application/javascript "access plus 1 month"
  ExpiresByType text/javascript "access plus 1 month"
  ExpiresByType font/woff2 "access plus 1 year"
  ExpiresByType font/woff "access plus 1 year"
  ExpiresByType font/ttf "access plus 1 year"
  ExpiresByType application/vnd.ms-fontobject "access plus 1 year"
</IfModule>
Config looks valid

Start from a preset

HTTPS & canonical host

Redirects every http:// request to https://.

Redirects

No custom redirects.

Rewrite rules

No custom rewrite rules.

Routes any missing file/dir to a single entry file.

Directory & error pages

Custom error documents

Performance

Cache these types

Security headers

nosniff — stop MIME-type sniffing

SAMEORIGIN — clickjacking protection

strict-origin-when-cross-origin

Force HTTPS for two years

Lock down camera/mic/geolocation

Legacy XSS filter (older browsers)

File & access control

Auth & hotlinking

Adds an AuthType Basic scaffold (needs an .htpasswd file).

Block other sites from embedding your images.

A builder, not a snippet dump

Hand-writing Apache mod_rewrite is unforgiving — one stray flag or a rule in the wrong order and your site stops loading. This tool models the whole .htaccess — HTTPS and www canonicalisation, redirects, rewrites, an SPA fallback, compression, per-type caching, security headers and access control — then emits clean output grouped into the conventional <IfModule> guards so directives degrade gracefully when a module is missing.

What the audit catches

  • An HSTS header set without forcing HTTPS first.
  • A redirect whose source equals its target — an instant loop.
  • A rewrite target using $1 when the pattern has no capture group.
  • Caching turned on with no file types, or hotlink protection with no allowed host.

Always test a generated .htaccess in staging — a bad rule can lock you out of the site.

Was this tool helpful?

Share Your Experience

Help others discover this tool!

Share on Twitter

Related tools