Why does my site show a 500 error after adding .htaccess?
A module is probably missing, or the host forbids a directive. Every block is wrapped in IfModule where possible; check the Apache error log for the exact line.
.htaccess Generator
One redirect, not a chain.
Tick the rules you need and get a commented .htaccess for Apache 2.4. HTTPS and the www choice collapse into a single 301, your domain is escaped correctly, and sensitive files such as .env.local and logs are blocked.
Loading the toolbox.
About 2htaccess
How Can You Verify That Nothing Leaves This Browser?
You do not have to take our word that your data stays here. Developer tools show every request a page makes, so you can watch this page work and confirm that nothing is sent. The check takes under a minute.
- Open your browser developer tools with
F12, orCmd+Option+Ion a Mac, and select the Network tab. - Reload the page and let it finish. You will see the page's own files, its web fonts, and one anonymous page-view request. Nothing has been typed yet, so none of them can contain your data.
- Click the clear icon in the Network tab so that the log is empty.
- Use the tool with your own input.
- Look at the Network tab again. It is still empty. For extra proof, turn on offline mode after the page loads and the tool keeps working.
Only two things can add a line to that log, and neither carries your data. Submitting the feedback form sends the vote and comment you typed. Typing characters in a script the page has not displayed yet, such as Cyrillic or Greek, can make the browser fetch the matching font file, and that request names only the font.
The production site also sends a Content-Security-Policy header that tells your browser to refuse connections to anywhere except this site and the anonymous analytics endpoint, so a coding mistake could not quietly send your data elsewhere.
What Is an .htaccess File?
An .htaccess file holds Apache configuration for one folder and everything under it. Shared hosts use it because customers cannot edit the main server config. It is read on every request, so on a server you control, the same rules belong in the virtual host instead, where they are faster. The rules this tool writes work in either place.
What Is a Redirect Chain, and Why Avoid It?
With separate rules for HTTPS and for www, a visitor to http://example.com is sent to https://example.com and then again to https://www.example.com. Every extra hop costs a round trip, and search engines follow only a limited number of them. The original 2htaccess produced exactly that chain.
This version writes both conditions joined with [OR] in front of one rule whose target is the final origin, so any wrong scheme or wrong host reaches the canonical URL in a single 301. Behind a load balancer or CDN that ends TLS, %{HTTPS} is always off; the output says to test X-Forwarded-Proto there instead.
Which Files Should a Web Server Refuse?
The vanilla deny rule only matched files named exactly .env or .log, so .env.local, .env.production, and error.log were served to anyone who asked. The new rule blocks:
- every .env file and its variants, such as .env.local and .env.production
- version control and credential dotfiles, such as .git, .svn, .htpasswd, and .npmrc
- logs, SQL dumps, SQLite databases, backups, editor swap files, private keys, and shell scripts
- composer and package manifests, which reveal exact dependency versions
Because FilesMatch only sees file names, the output also returns 404 for any path inside a .git, .svn, or .hg folder. .well-known stays reachable, since certificate renewal depends on it.
What Else Can It Generate?
- Compression of text, JSON, SVG, and XML with mod_deflate.
- Long cache lifetimes for fingerprinted assets, and no caching for HTML.
- Security headers and, once HTTPS is solid everywhere, HSTS.
- Quoted 301 redirects for moved pages, validated so a typo cannot break the file.
- Directory listing off, a custom 404, and a single-page-app fallback.
What Other Tools Are in the Generators Lane?
- 2uuid: UUID v4 and v7, ULID, and NanoID in bulk, plus a decoder that reads timestamps back out.
- 2gitignore: Pick your languages, frameworks, OS, and editor; get one merged, de-duplicated .gitignore.
- 2csp: Build a Content-Security-Policy header or meta tag, with nonces, hashes, strict-dynamic, and Report-Only.
- 2robots: A robots.txt with your sitemap, private paths, crawl delay, and plain-English notes.
Elsewhere in the toolbox: 2hash, 2base, 2otp, 2xml, and more on the 2toolbox home page. Part of the 2suite.io privacy-first ecosystem.
Frequently Asked Questions
Does this work on Nginx?
No. Nginx does not read .htaccess files. The same ideas apply, but the syntax is different.
Is the 301 permanent?
Browsers cache 301 redirects for a long time. Test with a 302 first if you are unsure, then switch.
Which Apache version is this for?
Apache 2.4. The file-blocking rule uses Require all denied, which replaced the 2.2 Order and Deny syntax.