25+ Rules

Apache .htaccess Configuration Cheat Sheet

Production Apache .htaccess snippets: force HTTPS, www redirect, Options -Indexes, IP blacklisting, SPA routing, and Gzip compression with 1-click copy.

Redirects & Canonical (4 commands)

Redirects & Canonical

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Forces all incoming unencrypted HTTP requests to HTTPS with permanent 301 redirect.

PRO TIP Essential for SEO to avoid duplicate content penalties between HTTP and HTTPS.

Redirects & Canonical

RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ https://%1/$1 [R=301,L]

Redirects www subdomains to apex naked domain (e.g. www.example.com -> example.com).

PRO TIP Concentrates PageRank authority to a single canonical domain endpoint.

Redirects & Canonical

Redirect 301 /old-page.html /new-page/

Simple mod_alias permanent 301 redirect for retired URLs or changed paths.

PRO TIP Use mod_rewrite for pattern-based regex matching; use Redirect for 1:1 path mappings.

Redirects & Canonical

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.html [L]

Single-Page Application (SPA) fallback routing for React, Vue, and Angular routers.

PRO TIP Serves existing static files directly and routes remaining dynamic routes to index.html.

Security & Headers (4 commands)

Security & Headers

Options -Indexes

Disables Apache directory index browsing when no index.html is present in a folder.

PRO TIP Crucial security best practice: prevents public users from browsing directory files.

Security & Headers

<FilesMatch "^\.(env|git|htaccess|sql)">
  Require all denied
</FilesMatch>

Blocks public web access to sensitive environment, git, and database configuration files.

PRO TIP Returns HTTP 403 Forbidden on any attempts to fetch /.env or /.git.

Security & Headers

Header set X-Content-Type-Options "nosniff"
Header set X-Frame-Options "SAMEORIGIN"
Header set Referrer-Policy "strict-origin-when-cross-origin"

Configures modern security response headers preventing MIME sniffing and clickjacking.

PRO TIP Requires Apache mod_headers module enabled.

Security & Headers

<RequireAll>
  Require all granted
  Require not ip 192.168.1.100
  Require not ip 10.0.0.0/24
</RequireAll>

Denies access from specific malicious IP addresses or whole CIDR subnet ranges.

PRO TIP Use for instant mitigation against rogue scrapers and brute-force bots.

Performance & Caching (3 commands)

Performance & Caching

<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css application/javascript application/json
</IfModule>

Enables Gzip compression for text, HTML, CSS, JavaScript, and JSON payloads.

PRO TIP Reduces asset transfer sizes by 65-80%, accelerating Core Web Vitals LCP.

Performance & Caching

<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType image/webp "access plus 1 year"
  ExpiresByType text/css "access plus 1 year"
  ExpiresByType application/javascript "access plus 1 year"
</IfModule>

Configures long-term browser cache expiry headers for static assets.

PRO TIP Combine with content-hashed filenames for safe, aggressive caching.

Performance & Caching

ErrorDocument 404 /404.html
ErrorDocument 500 /500.html

Directs Apache to serve custom branded error pages on 404 Not Found and 500 Server Error.

PRO TIP Maintains user retention and navigation pathways during broken link events.