.htaccess Generator

Generated .htaccess84 lines · 10 blocks

Lint: no issues found — blocks balanced, directives known.

# Generated .htaccess — Infinio Tools
# Domain: example.com
# Apache 2.2 / 2.4 — https://tools.infiniolabs.com/dev/htaccess-generator

<IfModule mod_rewrite.c>
RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

<IfModule mod_rewrite.c>
RewriteEngine On
    RewriteRule ^old-page(/.*)?$ /new-page$1 [R=301,L]
</IfModule>

# Block bad bots
<IfModule mod_rewrite.c>
RewriteEngine On
    RewriteCond %{HTTP_USER_AGENT} AhrefsBot [NC]
    RewriteCond %{HTTP_USER_AGENT} SemrushBot [NC]
    RewriteCond %{HTTP_USER_AGENT} MJ12bot [NC]
    RewriteCond %{HTTP_USER_AGENT} DotBot [NC]
    RewriteCond %{HTTP_USER_AGENT} BLEXBot [NC]
    RewriteCond %{HTTP_USER_AGENT} YandexBot [NC]
    RewriteCond %{HTTP_USER_AGENT} Baiduspider [NC]
    RewriteCond %{HTTP_USER_AGENT} Sogou [NC]
    RewriteCond %{HTTP_USER_AGENT} Exabot [NC]
    RewriteCond %{HTTP_USER_AGENT} Screaming Frog [NC]
    RewriteCond %{HTTP_USER_AGENT} rogerbot [NC]
    RewriteCond %{HTTP_USER_AGENT} UptimeRobot [NC]
    RewriteCond %{HTTP_USER_AGENT} python-requests [NC]
    RewriteCond %{HTTP_USER_AGENT} curl [NC]
    RewriteCond %{HTTP_USER_AGENT} wget [NC]
    RewriteCond %{HTTP_USER_AGENT} libwww-perl [NC]
    RewriteCond %{HTTP_USER_AGENT} HTTrack [NC]
    RewriteCond %{HTTP_USER_AGENT} Scrapy [NC]
    RewriteRule ^ - [F,L]
</IfModule>

# Security headers
<IfModule mod_headers.c>
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-XSS-Protection "1; mode=block"
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

# Block sensitive files
<FilesMatch "^(\.htaccess|\.env|\.git|\.htpasswd|.*\.log|.*\.sql)$">
    Require all denied
</FilesMatch>

<IfModule mod_expires.c>
ExpiresActive On
    ExpiresByType image/jpg image/jpeg image/png image/gif image/webp image/ico image/svg "access plus 1y"
    ExpiresByType image/css image/js image/mjs "access plus 1M"
    ExpiresByType image/woff image/woff2 image/ttf image/otf image/eot "access plus 1y"
    ExpiresDefault "access plus 1 month"
</IfModule>

# GZip compression
<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/plain text/css text/xml text/javascript application/javascript application/json application/xml application/rss+xml application/xhtml+xml image/svg+xml font/ttf font/otf application/vnd.ms-fontobject
    BrowserMatch ^Mozilla/4 gzip-only-text/html
    BrowserMatch ^Mozilla/4\.0[678] no-gzip
    BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
</IfModule>

# Server hardening
AddDefaultCharset UTF-8
ServerSignature Off

# Custom error pages
ErrorDocument 400 /400.html
ErrorDocument 401 /401.html
ErrorDocument 403 /403.html
ErrorDocument 404 /404.html
ErrorDocument 500 /500.html
ErrorDocument 503 /503.html

# Prevent directory browsing
Options -Indexes

What each block does

Canonical URLs (HTTPS / WWW / trailing slash)

Redirects every HTTP request to the HTTPS version with a permanent 301.

Redirect rules (1)

Each rule maps an old path to a new one with a 301 status code — use 301 for permanent moves, 302 for temporary ones.

Block bad bots (18 user-agents)

Returns 403 to known scraper bots and any custom user-agent patterns you added.

Security headers

Sets 6 HTTP response headers that harden the site against clickjacking, MIME sniffing and data theft.

Block sensitive files

Returns 403 for .htaccess, .env, .git, log files and SQL dumps.

Browser caching (mod_expires)

Tells browsers how long to cache each content type: Images=1y, CSS / JS=1M, Fonts=1y, HTML=0.

GZip compression (mod_deflate)

Compresses HTML, CSS, JS, JSON, XML and fonts before sending — smaller downloads, faster pages.

Server hardening

UTF-8 charset, No server signature.

Custom error pages (6 codes)

Serves your own HTML pages for HTTP error codes instead of the default Apache page.

Prevent directory browsing

Options -Indexes — visitors get 403 instead of a file listing when no index file exists.

.htaccess Generator

General

Redirect rules (301 / 302)

Security

Performance

Hardening & errors

Generated .htaccess84 lines · 10 blocks

What each block does