What Is .htaccess and What Can It Do?

Originally published: 2024-05-21

Technical update: 22 October 2026. An .htaccess file defines permitted directory-level configuration for Apache HTTP Server. Nginx does not process it. On Apache, the relevant AllowOverride or AllowOverrideList permissions must be enabled by the administrator for the file to take effect.

Location and appropriate use

On shared hosting, the file is commonly located in the website’s document root; files in subdirectories can also apply within their scope. Enable hidden-file display if the dot-prefixed name is not visible. Where you control the main server configuration, managing rules there is often preferable. See the official Apache .htaccess guide for permissions and performance considerations.

Before changing a rule

Keep a copy of the current file and preserve application-managed blocks such as WordPress rules. Change one thing at a time and test both the homepage and deeper URLs. If a change causes a 500 response, revert it and inspect the error log. For a new production redirect, testing with a temporary 302 before switching to a permanent 301 can reduce browser-cache troubleshooting problems.

Access control in Apache 2.4

Use Apache 2.4 Require rules instead of the old Order, Allow and Deny directives. The following denies access in its directory; accidentally placing it in the site root can block the whole website:

Require all denied

To restrict direct web access to one file:

<Files "config.php">
    Require all denied
</Files>

This does not replace operating-system permissions or application security. See Apache access control.

A permanent redirect for one page

A simple old-to-new page move may only need Redirect. Replace the domain and paths with your own:

Redirect 301 /old-page https://example.com/new-page

For HTTPS or canonical-host redirects, consider existing CDN, reverse-proxy and application rules together. Behind a proxy, checking only the local HTTPS state can create a redirect loop. Prefer a fixed, validated hostname over reflecting an arbitrary incoming Host header into the destination. Apache’s redirect examples distinguish the different scenarios.

Defining a 404 page

ErrorDocument 404 /404.html

The file must exist. Test a missing URL and confirm that the response remains HTTP 404 while showing the custom page. See the ErrorDocument directive.

Expiring static assets

If mod_expires is enabled and these directives are permitted, this example gives CSS, JavaScript and WebP files a one-week lifetime:

<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css "access plus 7 days"
    ExpiresByType application/javascript "access plus 7 days"
    ExpiresByType image/webp "access plus 7 days"
</IfModule>

Do not apply the same public caching policy to personalised pages, sessions or checkout responses. Plan versioned filenames and cache invalidation for updates. Writing a max-age string into an Expires header is not the correct format; use mod_expires and appropriate Cache-Control directives.

What should you check when choosing hosting?

For web hosting or WordPress hosting, confirm the web server, .htaccess support and permitted directives. With a cloud server you administer, also plan virtual-host configuration, testing and rollback responsibilities. A rule working on another website does not guarantee that it will work in your environment.