.htaccess Generator

Before you touch .htaccess: back it up

An .htaccess file is read on every single request. One unsupported directive or stray character and the whole folder returns a 500 Internal Server Error. So before you paste anything:

1. Download your existing .htaccess from public_html (turn on "show hidden files" in File Manager) and keep a copy on your machine.
2. If the site runs WordPress, leave the # BEGIN WordPress ... # END WordPress block exactly as it is, and paste these rules above it.
3. Upload, then immediately load the homepage, an inner page, an image and a URL that should 404. If anything breaks, restore the backup and add sections back one at a time.

The download button saves the file as htaccess.txt because many operating systems hide or rename files that start with a dot. Rename it to .htaccess after uploading.

Why the order of rules matters

mod_rewrite processes rules top to bottom. This generator puts them in a deliberate sequence: maintenance and bot blocking first (cheapest to reject), then your specific 301 redirects, then the HTTPS and www canonical redirect, then clean-URL handling. Specific redirects come before the canonical rule and point straight at the final absolute URL, so an old http://www link reaches its new home in one hop instead of three. Redirect chains waste crawl budget and add latency on mobile.

HTTPS and www are combined into a single rule for the same reason:

RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\. [NC]
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]

If your site sits behind Cloudflare or another proxy, the server may always see plain HTTP and this rule will loop. In that case replace the first condition with RewriteCond %{HTTP:X-Forwarded-Proto} !https, or let the proxy handle the HTTPS redirect.

Caching and compression

The caching block tells browsers how long they may reuse images, CSS, JavaScript and fonts without asking the server again, while HTML is always revalidated so content updates appear immediately. Be careful with long CSS and JS lifetimes: if your file names never change (style.css rather than style.a91f.css), returning visitors could see stale styles for the full period. One month is a safe middle ground for un-versioned files. Gzip typically shrinks text files by 70% or more. Hostinger runs LiteSpeed, which handles Brotli on its own, so the Brotli block only matters on Apache servers with mod_brotli.

Security headers, briefly

• HSTS tells browsers to use HTTPS for your domain for a year, even if someone types http. With preload you can submit the domain to the browser preload list, which is very slow to reverse. Only add it when every subdomain is on HTTPS for good.
• nosniff stops browsers guessing file types, which closes a class of upload-based attacks.
• Framing protection prevents other sites embedding yours in an iframe for clickjacking. Turn it off if you intentionally embed your pages elsewhere.
• Permissions-Policy switches off powerful browser APIs your site does not use. Remove an entry if a feature (a map with geolocation, say) stops working.

Maintenance mode and allowlisted IPs

Maintenance mode answers every request with a 503 status and your maintenance page, while visitors from the listed IP addresses see the live site. The 503 status matters: it tells search engines the outage is temporary, so they keep your rankings and retry later. Search "what is my IP" to find yours, and remember that mobile data and many home connections change IP regularly. If you are behind Cloudflare, the server sees Cloudflare's IP, so swap %{REMOTE_ADDR} for %{HTTP:CF-Connecting-IP}.

Test every change

After uploading, check redirects in a private window (browsers cache 301s hard), confirm headers with your browser's network panel or an online header checker, and run a couple of URLs through Search Console's URL Inspection tool. Ten minutes of testing beats a weekend of lost traffic.

Frequently asked questions