Build an Apache .htaccess with forced HTTPS, www handling, 301 redirects, compression, caching and security headers, commented and ready to use.
The .htaccess file controls Apache server behavior per directory: redirects, URL rewrite rules, compression, caching and security. Writing these directives by hand is error-prone, a malformed rewrite rule can take the whole site down. This generator builds a commented .htaccess from clear options: force HTTPS, normalize www usage, create 301 (permanent) or 302 (temporary) redirects, enable Gzip compression and browser caching, block directory listing, protect sensitive files like .env and .git, add security headers and set up the SPA fallback for React, Vue or Angular apps. Each block sits inside an <IfModule> so it won't break the server if a module isn't enabled. Copy the result and save it as .htaccess at the site root. Everything is generated locally, with no data sent.
Paste the code into your HTML and the tool shows up on your page, without J-Kit's navigation and ads. It still runs in the browser of whoever visits your site.
<iframe
src="https://jkit.tools/embed/en-US/htaccess-generator"
width="100%"
height="600"
style="border:0"
loading="lazy"
title=".htaccess Generator"
></iframe>These references help contextualize formulas, standards, APIs and limitations used on this page. They do not replace professional validation when a result has legal, financial, medical or operational impact.
In the site's root folder (usually public_html or www) or the specific directory you want to configure. The rules apply to that directory and its subdirectories. The file name is exactly .htaccess, with a leading dot and no extension.
# .htaccess gerado por jkit.tools
# Apache 2.4+ · mod_rewrite, mod_headers, mod_deflate, mod_expires
<IfModule mod_rewrite.c>
RewriteEngine On
# Força HTTPS
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
# Remove o www
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^(.*)$ https://%1/$1 [L,R=301]
</IfModule>
# Desativa a listagem de diretórios
Options -Indexes
# Protege arquivos sensíveis
<FilesMatch "^\.(htaccess|htpasswd|env|git)">
Require all denied
</FilesMatch>
<IfModule mod_headers.c>
# Cabeçalhos de segurança
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>
<IfModule mod_deflate.c>
# Compressão Gzip
AddOutputFilterByType DEFLATE text/html text/plain text/css text/javascript
AddOutputFilterByType DEFLATE application/javascript application/json application/xml
AddOutputFilterByType DEFLATE image/svg+xml
</IfModule>
<IfModule mod_expires.c>
# Cache do navegador
ExpiresActive On
ExpiresByType image/jpeg "access plus 1 year"
ExpiresByType image/png "access plus 1 year"
ExpiresByType image/svg+xml "access plus 1 year"
ExpiresByType text/css "access plus 1 month"
ExpiresByType application/javascript "access plus 1 month"
ExpiresByType text/html "access plus 0 seconds"
</IfModule>
The file is built entirely in your browser from the options you choose. Nothing is sent to any server.