Where do I put the .htaccess file?

In the top folder of your website, the one that holds index.php or index.html. A file in a subfolder only affects that folder.

How do I redirect HTTP to HTTPS in .htaccess?

Use RewriteCond %{HTTPS} off followed by a RewriteRule to https://%{HTTP_HOST}%{REQUEST_URI} with R=301, as in the generated file.

Does .htaccess work on nginx?

No. Nginx ignores .htaccess files. You put the same rules in the nginx server block instead.

.htaccess generator: HTTPS redirect, www, caching and more

Build an Apache .htaccess file with an HTTPS redirect, www rules, compression, caching and a front controller.

For Apache 2.4 with mod_rewrite. Many shared hosts allow it. Not for nginx or IIS.

An .htaccess file lets you change how Apache behaves for one site without touching the main server config. Tick what you need, then save the result as .htaccess in your site's top folder.

Create your config file

Type your own values. The file below updates as you type, and nothing you type leaves your browser.

.htaccess

<IfModule mod_rewrite.c>
RewriteEngine On

# Redirect HTTP to HTTPS
RewriteCond %{HTTPS} off
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</IfModule>

# No folder listings
Options -Indexes

# Hide dotfiles and .git
<FilesMatch "^\.">
  Require all denied
</FilesMatch>
RedirectMatch 404 "/\.git"

<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/css text/xml application/javascript application/json application/xml image/svg+xml
</IfModule>

<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType image/jpeg "access plus 1 year"
  ExpiresByType image/png "access plus 1 year"
  ExpiresByType image/gif "access plus 1 year"
  ExpiresByType image/webp "access plus 1 year"
  ExpiresByType image/svg+xml "access plus 1 year"
  ExpiresByType text/css "access plus 1 month"
  ExpiresByType application/javascript "access plus 1 month"
</IfModule>

How this setup works

Diagram: Browser, then Apache, then Rules run — Browser (asks for a page) → Apache (reads .htaccess) → Rules run (redirect, compress, cache)

Step-by-step setup

Save the lines above as .htaccess (with the dot) in your site's top folder, next to index.php or index.html.
Make sure Apache allows it: the site's config needs AllowOverride All, and mod_rewrite must be on.
Open your site in a private window, so old redirects in the browser cache do not confuse the test.
If you see a 500 error, read /var/log/apache2/error.log. It names the line that failed.
Turn on one option at a time if something breaks, to find the line that causes it.

What the important lines mean

RewriteRule … [R=301,L] sends a permanent redirect and stops reading further rules.
X-Forwarded-Proto stops a redirect loop when a proxy or CDN handles HTTPS in front of Apache.
Options -Indexes hides the file list when a folder has no index file.
ExpiresByType tells browsers how long they may keep a file before asking again.

Common errors and how to fix them

500 Internal Server Error after saving the file: A line is not allowed or a module is off. Read the Apache error log. Common causes are AllowOverride too strict for Options, or mod_rewrite, mod_expires or mod_deflate not enabled.
ERR_TOO_MANY_REDIRECTS: HTTPS is handled by a proxy, CDN or load balancer, so Apache always sees plain HTTP. The X-Forwarded-Proto line covers most setups. Also check the www rule is not fighting another one in your CMS.
My .htaccess changes do nothing: The server ignores the file. Set AllowOverride All for your site folder and reload Apache. Nginx never reads .htaccess.
Every page shows 404 after adding index.php routing: Your app must handle the path itself, and the file must really be called index.php in the same folder. Check that mod_rewrite is enabled.

Frequently asked questions

Where do I put the .htaccess file?: In the top folder of your website, the one that holds index.php or index.html. A file in a subfolder only affects that folder.
How do I redirect HTTP to HTTPS in .htaccess?: Use RewriteCond %{HTTPS} off followed by a RewriteRule to https://%{HTTP_HOST}%{REQUEST_URI} with R=301, as in the generated file.
Does .htaccess work on nginx?: No. Nginx ignores .htaccess files. You put the same rules in the nginx server block instead.

Written for: Apache 2.4 · Updated 2026-10-11

Free tools that help

chmod calculatorTick read, write and execute for owner, group and others to get the chmod number, symbolic form and command. Or type 755 and see what it means.

Fix a problem with this setup

Localhost redirected too many timesFix ERR_TOO_MANY_REDIRECTS on localhost: clear cookies, fix HTTP and HTTPS rules, and WordPress URL settings.
XAMPP Apache not startingWhy Apache stops right after starting in XAMPP, and how to change its port or free port 80.

More server configs

robots.txt fileCreate a robots.txt that tells search engines what to crawl, with a sitemap line and optional AI crawler blocks.
nginx redirect www to non-wwwSend www.example.com to example.com (or the reverse) with one permanent redirect.
nginx load balancer configSplit traffic across two or three copies of your app with an nginx upstream block.
nginx rate limit configSlow down abusive visitors with limit_req: a request rate per IP, a burst, and a 429 answer.
php.ini settingsSet the PHP values most sites need: upload size, memory, run time, errors, time zone and OPcache.
MySQL my.cnf settingsA small MySQL or MariaDB override file for connections, memory, character set and the slow query log.

See all 41 config generators