htaccess
✂A collection of useful .htaccess snippets.
A copy-paste collection of Apache .htaccess snippets for URL redirection, security hardening, performance tuning, and common web server configuration tasks, no hunting through separate docs required.
This repository is a reference collection of .htaccess snippets for Apache web servers. An .htaccess file is a small configuration file you place inside a folder on your web server to control how Apache handles requests to that folder, without touching the main server settings. This repo gathers copy-paste-ready examples so you do not have to hunt them down from separate sources.
The snippets are organized into four areas. The first covers URL rewriting and redirection: forcing or removing the "www" prefix, redirecting HTTP traffic to HTTPS, removing trailing slashes, sending visitors from old pages to new ones, and setting up clean URLs that hide file extensions. Each snippet is a short block of Apache configuration syntax with a plain explanation of what it does.
The second area covers security. It includes snippets for blocking all visitors except a specific IP address, hiding sensitive files from direct access, disabling directory listing, preventing your images from being loaded by other websites, password-protecting directories or individual files, blocking visitors from particular referrer sites or browser agents, and setting HTTP security headers such as Content Security Policy and Referrer Policy.
The third area covers performance: compressing text responses, setting browser cache expiration times, and configuring Cache-Control headers.
The fourth area covers miscellaneous tasks: setting custom error pages, forcing file downloads, allowing fonts to load across different domains, enabling CORS, and switching which PHP version Apache uses.
The README is written for Apache 2.4. It notes that .htaccess files are slower than editing the main server config, and recommends using them only when you do not have access to that config. You use the snippets by copying the relevant block into your own .htaccess file and adjusting domain names or paths where needed.
Where it fits
- Force HTTPS and remove or add the www prefix for all visitors to your website.
- Block directory listing, protect sensitive files, and set HTTP security headers like Content Security Policy.
- Enable gzip compression and set browser cache expiration headers to speed up your site.
- Set up custom error pages and allow fonts and assets to load across different domains.