Online .htaccess and nginx generator

Create 301 redirects for pages, folders or whole domains, force HTTPS and www, password-protect folders and add error pages, IP blocking and hotlink protection without writing a single rule by hand.

Pick your server, tick what you need and the config is built as you type, ready to copy or download: a .htaccess for Apache 2.4 or the equivalent block for nginx. The rules are ordered so every visit reaches its destination in a single redirect: the domain move first, then HTTPS and www, and finally your specific redirects.

Built for site migrations, URL changes, moving a site from Apache to nginx and that moment when your hosting provider says "put this in the .htaccess". If you already have a file, paste the generated rules at the top, before your CMS rules (WordPress, PrestaShop…), so they run first.

Server
Canonical domain
Domain move
Page and folder redirects

Type the path (/old-page.html) or paste the full URL. As the destination, use a path on the same site or a URL on another domain.

Custom error pages
Folders
Password protection
An absolute path, ideally outside the site's public folder.
nginx does not support bcrypt on every distribution, so APR1-MD5 is used.

Passwords are hashed in your browser: neither they nor the result are sent to any server.

Block IPs
Hotlink protection

    Tick an option to generate the rules.

    It downloads as htaccess.txt because many systems hide or rename files that start with a dot: upload it to your site root and rename it to .htaccess.

    Paste the block inside your site's server { } (in /etc/nginx/sites-available/ or conf.d/), before your location blocks. If you have one server for port 80 and another for 443, paste it into both.

    Create the file on the server with this content (it downloads as htpasswd.txt). Without it, nobody will be able to enter the protected area. The user nginx runs as (usually www-data or nginx) must be able to read it.

    Which redirect to choose

    • 301 · Permanent: the page has moved for good. It is the one you want in a migration: search engines pass the ranking on to the new URL and browsers remember it.
    • 302 · Temporary: the original URL will come back (a campaign, a page under maintenance). Google keeps the old one indexed.
    • 307 and 308: equivalent to 302 and 301, but they guarantee the method is kept; handy when redirecting forms or API POST calls.
    • 410 · Gone: the page no longer exists and has no replacement. Search engines drop it sooner than with a 404.

    Page or folder

    A page redirect only affects that exact URL. A folder redirect also moves everything under it: /blog/ to /news/ takes /blog/my-post to /news/my-post. If the source includes parameters (/product.php?id=7), the rule only fires with those parameters and does not carry them to the destination.

    Password-protected folders

    Protection uses HTTP basic authentication: the browser shows a username and password prompt and the server checks them against the .htpasswd file, which stores every password hashed, never in plain text. bcrypt is the strongest hashing Apache supports; APR1-MD5 works on both Apache and nginx. Since the password travels with every request, always use HTTPS on the protected area.

    Apache or nginx

    Apache reads the .htaccess on every request, so uploading it is enough. nginx has no per-folder files: the rules go into the site config and nginx has to be reloaded after checking it with nginx -t. Both outputs do the same; on nginx a folder password applies to everything under it, .php files included, which a standalone location does not guarantee.

    Back up your current config before uploading: on Apache, a syntax error returns a 500 across the whole site. After uploading, test the URLs in a private window, because browsers cache 301 redirects.

    Contacto

    Los campos marcados con * son obligatorios.

    Si lo prefieres, llámanos: +34 910 884 356