# Apache .htaccess Snippets

URL: https://phishdestroy.io/developer-tools/htaccess-snippets
Category: General dev
Where it runs: Runs locally (nothing you enter is uploaded)

Combine common Apache .htaccess blocks into one file: HTTPS redirect, HSTS, security headers, caching, compression, IP blocking and more.

## Example input

HTTPS and security headers

```
Keep the default ticks (HTTPS Redirect and Security Headers) and press Generate.
```

A RewriteRule that sends http:// requests to https:// with a 301 redirect, followed by four Header set lines.

## FAQ

### What do I need to change before using a snippet?

Replace the placeholders: yourdomain.com in Block Hotlinking and the sample addresses in Block IPs. The blocks need mod_rewrite, mod_headers, mod_expires or mod_deflate, and Block IPs uses Apache 2.4 Require syntax.

### Are all the headers still recommended?

X-XSS-Protection is obsolete: major browsers have removed the XSS filter it controls, and current guidance is to omit it or send 0, so delete that line from Security Headers. Keep preload in the HSTS header only if every subdomain serves HTTPS and you plan to submit the domain to the browser preload list.

### Is anything sent to my server?

No. The tool only joins the selected snippets into text in your browser, and nothing is uploaded. Test the file on a staging site first, because a syntax error in .htaccess makes Apache answer 500 for the whole directory.

## Related tools

- [CSP Header Builder](https://phishdestroy.io/developer-tools/csp-header-builder)
- [CORS Headers Generator](https://phishdestroy.io/developer-tools/cors-headers-generator)
- [robots.txt Generator](https://phishdestroy.io/developer-tools/robots-txt-generator)
- [security.txt Generator](https://phishdestroy.io/developer-tools/security-txt-generator)
- [HTTP Headers Reference](https://phishdestroy.io/developer-tools/http-headers-reference)

All tools: https://phishdestroy.io/developer-tools