SEOlust logo SEOlust
Security & Privacy

.htaccess Security Generator

Generate a hardened .htaccess — force HTTPS, block sensitive files, disable directory listing, stop hotlinking and bad bots, and add security headers. Copy or download. Free.

All tools
.env, .git, composer.json, .htpasswd, backups, logs…

💡 How to use

  • Pick the hardening rules you want and copy the generated .htaccess to your site's root.
  • These rules work on Apache servers. Always test on a staging copy first — a bad rule can lock you out.
  • Runs entirely in your browser — nothing is uploaded.

Free .htaccess Security Rules Generator

Generate a hardened Apache .htaccess file in seconds. Toggle rules to force HTTPS, block sensitive files, disable directory listing, add security headers, stop hotlinking, and block bad bots — then copy or download a ready-to-use .htaccess. Free, no sign-up, runs in your browser.

What this tool does

The <code>.htaccess</code> file is where a lot of Apache security is configured, but the syntax is fiddly and easy to get wrong. This generator lets you tick the protections you want and produces a correct, well-commented <code>.htaccess</code> you can drop into your site's root — covering the most common hardening steps in one place.

How to use it

It is instant:

  • Select the security rules you want to include.
  • Enter your domain for redirects and hotlink protection.
  • Copy or download the generated .htaccess.
  • Test it on a staging copy, then deploy to your site root.

What the rules protect against

<strong>Force HTTPS</strong> redirects all traffic to the secure version. <strong>Block sensitive files</strong> denies access to <code>.env</code>, <code>.git</code>, config, backup, and log files that often leak secrets. <strong>Disable directory listing</strong> stops visitors browsing your folders. <strong>Security headers</strong> add clickjacking, MIME, and referrer protections. <strong>Block bad bots</strong> filters aggressive scrapers, and the WordPress rules block <code>xmlrpc.php</code> abuse and PHP execution in the uploads folder.

Why block sensitive files

One of the most common site compromises comes from a publicly accessible <code>.env</code> or <code>.git</code> folder, which can expose database passwords, API keys, and full source code. Denying access to these files at the server level closes that hole regardless of your app. It pairs well with keeping such files outside the web root, and you can confirm they're protected with our Sensitive File Exposure Scanner.

Test before you deploy

An <code>.htaccess</code> rule that's wrong for your server can cause a 500 error or lock you out, so always test on a staging copy first and keep a backup of your existing file. These rules assume common Apache modules (<code>mod_rewrite</code>, <code>mod_headers</code>) are enabled; if a block causes errors, remove it and check which module is missing. On Nginx, use our Security Headers Generator instead, since <code>.htaccess</code> is Apache-only.

Privacy

The file is generated entirely in your browser from your selections — nothing is uploaded, logged, or stored. You can prepare hardening rules for private or internal sites without any details leaving your device.

FAQ

Is this .htaccess generator free?
Yes. It is completely free, runs in your browser, and needs no account or sign-up.
Where do I put the .htaccess file?
In your website's root directory on an Apache server. Test on a staging copy first and keep a backup of any existing .htaccess.
Does this work on Nginx?
No. .htaccess is Apache-only. For Nginx, use our Security Headers Generator to get add_header directives for your server block.
Why block .env and .git files?
They frequently contain database passwords, API keys, and source code. If they're web-accessible, attackers can read them. Denying access closes that common hole.
Can a bad rule break my site?
Yes. A wrong or unsupported directive can cause a 500 error. Always test on staging, keep a backup, and remove any block that causes issues.
Are my settings uploaded?
No. The .htaccess is generated locally in your browser, so your settings never leave your device.
How do I confirm the sensitive-file rules work?
After deploying, use our Sensitive File Exposure Scanner and Directory Listing Checker to verify the files and folders are properly protected.

Related tools

Pro tip: pair this tool with Robots.txt Exposure Checker and Cookie Security Checker for a faster SEO workflow.