Build a complete, commented .htaccess for Apache 2.4: HTTPS and www in one hop, security headers, caching, Brotli, bot blocking, protected files and your CMS. Every block links to the section of THE Ultimate Htaccess 2026 that explains it.
Upload as .htaccess to your document root. If the site answers 500 right away, your host has not enabled a module or AllowOverride for one of the blocks: remove blocks until it works and read the linked section. Check the result with the security headers checker.
Build a complete .htaccess in one pass
Tick the blocks you want and the generator writes a clean, commented .htaccess for Apache 2.4. Every block is wrapped in <IfModule>, so a missing module never takes your site down with a 500. Copy the result, download it, or send it to the .htaccess tester first. Everything runs in your browser; your settings stay in the page link so you can come back to them.
What each block does
Canonical URLs
Force HTTPS and pick www or non-www in a single 301, with proxy-aware detection for Cloudflare and load balancers. For bulk moves use the redirect generator.
Security
- Deny access to dotfiles (
.git,.env,.svn) while keeping/.well-known/open for Let's Encrypt. - Block backups and source files:
*.bak,*.sql,*.swp,*~,composer.json,wp-config.php. - Turn off directory listings with
Options -Indexesand hide the server signature. - Refuse
TRACEand other methods you never use.
<FilesMatch "(^\.|\.(bak|sql|swp|log|ini)$|~$)"> Require all denied </FilesMatch> Options -Indexes
Security headers
HSTS, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy, frame protection and a starter Content-Security-Policy. Headers are set with Header always set so they also go out on error pages. Check the live result with the security headers checker.
Caching
Long Cache-Control lifetimes with immutable for versioned CSS, JS, fonts and images, and a short or no-cache policy for HTML so new content shows up straight away. ETags are kept consistent across servers.
Compression
Brotli through mod_brotli where available, with gzip through mod_deflate as the fallback, for text types only. Images and archives are already compressed and are skipped.
CMS front controller
The standard WordPress, Laravel or generic index.php block, placed last so your own rules run first.
Order matters
mod_rewrite rules run top to bottom, so redirects go first, then access rules, then the front controller. The generator always writes the blocks in that order. If you paste the output into an existing file, keep your CMS's own block at the bottom.
FAQ
Will this slow my site down?
A few dozen lines cost microseconds. Apache does reread .htaccess on every request, though, so if you control the server, move the same directives into the VirtualHost and set AllowOverride None. See the 2026 .htaccess guide for details.
I got a 500 error after uploading. Why?
Usually a directive your host does not allow in .htaccess, such as Options under a restrictive AllowOverride. The Apache error log names the exact line. Remove that block and regenerate.
Does it work on LiteSpeed?
LiteSpeed reads Apache .htaccess and supports nearly everything here, including mod_rewrite and headers.