.htaccess Generator for Redirects, HTTPS and Security

One wrong character in .htaccess can turn a working site into a 500 error, and that single file controls redirects, HTTPS, security headers and caching. Kwebby's .htaccess Generator builds those rules from options you tick, so you choose what you need and copy the output. It covers HTTPS and WWW redirects, custom 301 and 302 redirects, security headers, hotlink protection, Gzip, browser caching and custom error pages. An AI Generate tab sits beside the builder.

Key Takeaways

• Kwebby's .htaccess Generator builds Apache rules from grouped options for redirects, security, performance and error pages, and shows the result in a Generated .htaccess panel.
• Redirect options include Force HTTPS, WWW to non-WWW, non-WWW to WWW, Remove Trailing Slash, and custom URL redirects with a 301 or 302 status.
• Google treats permanent redirects (301, 308) as a signal that the target should be canonical. Temporary redirects (302, 303, 307) keep the source page in search results.
• Roll out HSTS and Content Security Policy with care. MDN warns that HSTS cannot be quickly undone, and CSP can block inline scripts.
• .htaccess works on Apache servers only, and only where AllowOverride allows it. Nginx servers use a different configuration file.
• Back up your current .htaccess file before every change. The tool is free and needs no account.

What Is the Kwebby .htaccess Generator?

The Kwebby .htaccess Generator is a free web tool that builds Apache .htaccess files from a set of options. You tick the redirects, security rules, performance settings and error pages you want, and the tool writes matching rules in a Generated .htaccess panel. You copy the output into your site's .htaccess file. No account is needed.

An .htaccess file is an Apache configuration file that applies per directory. It handles redirects, URL rewriting, access control and more without changes to the main server configuration. The generator saves you from writing that syntax by hand.

Key Features and How It Works

The Builder tab groups options into four sections. Each tick adds matching lines to the output.

Redirects

• Force HTTPS (HTTP → HTTPS): sends all HTTP traffic to the HTTPS version.
• WWW → Non-WWW and Non-WWW → WWW: choose one preferred hostname form. Ticking one clears the other.
• Remove Trailing Slash: strips the trailing slash from URLs.
• Custom URL Redirects: map an old URL to a new one and choose 301 or 302. Click + Add redirect to add more rows.

Security

• Security Headers: adds X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. With Force HTTPS ticked it also adds Strict-Transport-Security with a max-age of one year (31536000) and includeSubDomains, plus a comment suggesting a short max-age while you test. It does not add the deprecated X-XSS-Protection header.
• Content Security Policy (CSP): adds default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';, which blocks scripts, styles, fonts and images from other domains until you edit it.
• Disable Directory Listing: stops Apache from listing folder contents.
• Block Dot Files: protects files such as .env and .git.
• Block Bad SEO Bots: blocks AhrefsBot, MJ12bot, DotBot, SemrushBot, BLEXBot and DataForSeoBot with Apache 2.4 Require rules. No search engine crawler is on the list.
• Hotlink Protection: stops other sites from loading your images.

Performance

• Gzip Compression: compresses text responses.
• Browser Caching: sets expiry of 1 year for images and 1 month for CSS and JavaScript.

Pages

• Custom Error Pages: sets pages for 400, 403, 404, 500 and 503 errors.

AI Generate

The page also has an AI Generate tab ("Also Generate with AI") for building a file with AI help. The Generated .htaccess panel shows the result as you change options, with a Copy button.

Why the Redirect Type Matters

A permanent redirect and a temporary redirect tell search engines different things. Google's documentation on redirects and Google Search says permanent redirects (301 and 308) show the new target in search results and signal it should be canonical. Temporary redirects (302, 303 and 307) keep the source page in results.

Use 301 when you are sure a move is permanent, such as a new URL structure or a switch to HTTPS. Use 302 for genuinely short-term changes, such as a page that is offline for maintenance. Google also notes that server-side redirects are the most reliable way to send users and Search to the right page, which is what .htaccess rules provide.

How to Use the .htaccess Generator

Building a file takes six steps.

1. Open the Builder tab. The Redirects, Security, Performance and Pages groups appear with their options.
2. Tick your redirect options. Start with Force HTTPS and choose one hostname rule, either WWW → Non-WWW or Non-WWW → WWW. Do not tick both.
3. Add custom redirects. Enter the old URL and the new URL, choose 301 or 302, and click + Add redirect for each extra row.
4. Add security and performance options. Tick only what you understand and can test, such as Disable Directory Listing, Gzip Compression and Browser Caching.
5. Review the Generated .htaccess panel. Read the rules, then click Copy.
6. Paste, save and test. Back up your existing .htaccess file, paste the new rules, save, and load your site and a few old URLs to confirm the behavior.

Best Practices for .htaccess Rules

A good .htaccess change is small, backed up and tested. These habits prevent most outages.

Back Up Before You Paste

Save a copy of the current file before every edit. A syntax error can take down the whole site, and a backup lets you restore it in seconds. Change one group of options at a time so you can find the cause if something breaks.

Choose 301 or 302 on Purpose

The common mistake is a 302 for a permanent move. Search engines may keep the old URL in results because a temporary redirect does not signal a new canonical. Use 301 for permanent moves and 302 only when you plan to bring the old URL back.

Pick One Hostname and One Scheme

Choose either the www or the non-www version and stick with it. Ticking both hostname options creates a loop because each rule sends visitors to the other. After you save, check that a visitor reaches the final URL in a single hop. The WWW Redirect Checker shows every hop.

Confirm Your Certificate Before You Force HTTPS

Forcing HTTPS sends all visitors to the secure version, so the certificate must be valid first. Check it with the SSL Checker before you tick Force HTTPS.

Roll Out HSTS Slowly

MDN's guide to the Strict-Transport-Security header says to start with a short max-age and warns that HSTS cannot be quickly undone. Test your HTTPS redirect first, then raise the lifetime when you are sure every page works over HTTPS.

Test CSP Before You Rely on It

A Content Security Policy tells browsers which resources a page may load. MDN notes that inline scripts stop working under common CSP directives unless you use nonces or hashes. Test the policy on a staging copy and watch for broken scripts, fonts and embeds.

Think Before You Block SEO Bots

The Block Bad SEO Bots option stops crawlers from tools such as Ahrefs, MJ12 and Semrush. That also blocks your own audits with those tools. Tick it only if you want that effect.

Use the Main Server Config When You Can

Apache's .htaccess how-to says to put configuration in the main server file when you have access, because .htaccess files cost performance on every request. Shared hosting often limits you to .htaccess, and then it is the right tool.

Common Use Cases

• Moving to HTTPS. Tick Force HTTPS, then check the result with a redirect tracer.
• Choosing one hostname. Send www traffic to the non-www version, or the other way around, to keep one canonical address.
• Site restructure. Add custom 301 redirects from old URLs to their new paths.
• Shared hosting hardening. Disable directory listing, block dot files and add security headers.
• Faster repeat visits. Turn on Gzip Compression and Browser Caching, then confirm with the Check Gzip Compression tool.

Related Kwebby Tools

The .htaccess Generator is one of our server tools in the Developer Tools collection. These tools work alongside it:

• URL Rewriting Tool generates mod_rewrite rules for clean URLs, a rewrite where the address bar does not change.
• Nginx Config Generator builds server blocks for Nginx, which does not use .htaccess.
• WWW Redirect Checker traces every redirect hop so you can confirm your rules.
• Robots.txt Generator controls which crawlers may visit which paths, a different layer from blocking them at the server.
• Get HTTP Headers shows the security and caching headers your server actually sends.

Frequently Asked Questions (FAQs)

What is a .htaccess file?

An .htaccess file is a configuration file used by Apache web servers. It controls server behavior per directory, including redirects, URL rewriting, access control and caching. You can use it without editing the main server configuration.

What is the difference between 301 and 302 redirects?

A 301 is a permanent redirect, and Google treats it as a signal that the target URL should be canonical. A 302 is temporary, and Google keeps the source page in search results. Use 301 for permanent moves and 302 for short-term changes.

Do I need Apache to use .htaccess?

Yes. .htaccess files only work on Apache servers where AllowOverride permits them. Nginx servers use their own configuration files, and you can build them with the Nginx Config Generator. Other platforms, such as Node.js, use code-level redirects.

How do I force HTTPS with .htaccess?

Tick Force HTTPS (HTTP → HTTPS) in the Redirects group, then copy the generated rules into your .htaccess file. The rule sends HTTP requests to the HTTPS version with a 301 redirect. Confirm that your SSL certificate is valid before you save it.

Can a bad .htaccess file break my website?

Yes. A syntax error or a redirect loop can return a 500 error or make pages unreachable. Back up the file before each change, and keep the backup ready to restore.

Is the .htaccess Generator free?

Yes. The tool is free and needs no account. Tick your options, review the output and click Copy.

Final Thoughts

The .htaccess Generator gets you from "I need HTTPS and one hostname" to working rules in a few clicks, but the safety steps are on you. Back up the file, change one group at a time and test redirects after every save. Start with Force HTTPS and a hostname rule, trace the result, and add security and caching options once those work. If your server runs Nginx, switch to the Nginx Config Generator instead.