The config file, without the head-scratching.

.htaccess is powerful and unforgiving — one stray character and your whole site 500s. Tick what you need — HTTPS, www, redirects, caching, security — and copy out a clean, commented file. Built in your browser; nothing is sent anywhere.

Canonical URLs

Your domain (for hotlink rules & comments)

Force HTTPSRedirect every http:// request to https://

www

Trailing slash

301 / 302 redirects

From (path)To (path or URL)Type

Error pages

404 page

403 page

500 page

Hardening & performance

Disable directory listingStop visitors browsing folders with no index file Protect sensitive filesDeny access to .env, wp-config.php, .ht*, logs, backups Enable GZIP compressionSmaller, faster pages (mod_deflate) Browser cachingTell browsers to cache images, CSS & JS (mod_expires) Security headersX-Content-Type-Options, X-Frame-Options, Referrer-Policy… Block image hotlinkingStop other sites embedding your images (needs your domain)

Generated entirely in your browser. Nothing you enter is uploaded.

A good .htaccess is wasted on bad hosting.

These rules only sing on a server that's fast, supports them properly, and won't fall over. Centaur runs LiteSpeed — it reads .htaccess natively — with free SSL, plain pricing and a real person on support.

See hosting plans →

What .htaccess does

An .htaccess file is a per-directory configuration file read by Apache and LiteSpeed web servers. Drop it in your site's root and you can redirect URLs, force HTTPS, set custom error pages, switch on compression and caching, and lock down sensitive files — all without touching the main server config. It's enormously useful, and enormously easy to break: a single typo can take your whole site offline with a 500 error, which is exactly why a generator helps.

How to use the file

Copy or download the output, save it as a file literally named .htaccess (with the leading dot, no extension), and upload it to the root folder of your website. Test the site straight after. If anything misbehaves, rename the file to disable it and check the change you made — that's the quickest way back.

The most common wins

Forcing HTTPS and picking one canonical hostname (www or non-www) avoids duplicate-content and mixed-content problems and is good for SEO. 301 redirects preserve your search rankings when you move or rename pages. Compression and caching make pages load faster. And denying access to files like .env and wp-config.php closes off a classic source of leaks.

For people running their own site

Plain notes on getting online properly, once a week

Domains, hosting, performance and security basics. No noise, unsubscribe in one click.

Common questions

Does this work on Nginx?

No — .htaccess is an Apache and LiteSpeed feature. Nginx ignores it and needs its config converted to server blocks. Centaur hosting runs LiteSpeed, so .htaccess works out of the box.

My site broke after adding it — help!

Rename the file (e.g. to htaccess.bak) to switch it off and your site will come back. Then re-add rules a few at a time to find the one your host doesn't support. Some shared hosts disable certain modules (mod_headers, mod_expires); the file is written so those blocks are skipped if the module is missing.

Is anything uploaded?

No. The file is built entirely in your browser from the options you tick.

Generates a standard .htaccess for Apache/LiteSpeed as a starting point. Server setups vary — some hosts disable modules or override directives — so always test your site immediately after deploying, and keep a backup of any existing file. This is a configuration helper, not a guarantee.