Questions People Ask About .htaccess
Short answers to the things that come up most, from where the file lives to why Apache is ignoring it.
Setting Up and Troubleshooting the File
Where do I put the .htaccess file?
In the document root of the site, the same folder as index.php or index.html. A file placed in a subfolder only affects that folder and everything under it. The filename starts with a dot and has no extension, so watch out for editors that append .txt.
Why is my .htaccess file being ignored?
Apache only reads it when AllowOverride permits it for that directory in the main server config. Most shared hosts allow it already. If the file is read but a single rule does nothing, the module that rule needs is probably not loaded, which is what the IfModule guards around every generated block are protecting you from. The mod_authz_core documentation lists what the access directives need.
Why does my site show a 500 error after uploading?
A 500 almost always means a syntax error, or a directive Apache does not accept in that context. Restore your backup first, then add the blocks back one at a time until the error returns. The Apache error log names the exact line, which turns a guessing game into a two minute fix.
Why did my rule get left out of the output?
Because it would not have worked. Rules that conflict, point a path at itself, or contain characters that cannot be escaped safely are dropped, and each one is explained in the notice box above the option groups in the generator.
Should I use a 301 or a 302 redirect?
301 for a permanent move, so search engines transfer ranking signals to the new URL. 302 when the old URL is coming back, such as a seasonal page or a maintenance window. Browsers cache 301 responses hard, so test with a 302 and switch once you are sure. The setup guide has a table of the common cases.
Can I combine several blocks in one file?
Yes, and the order matters more than people expect. Rewrite rules run before caching and header directives, and a front controller such as the WordPress block has to come last because it matches everything left over. Paste blocks in by hand and that ordering is your job.
Do PHP settings work in .htaccess?
Only with mod_php. Most hosts run PHP-FPM or CGI now, where php_value lines are ignored, or throw a 500 without a guard around them. On those setups the equivalent settings belong in php.ini or a .user.ini file.
Is the output Apache 2.2 or 2.4 syntax?
Apache 2.4. Access control uses Require rather than the older Order, Allow from and Deny from. Every access block carries the 2.2 equivalent as a comment, so a server still running 2.2 is a copy and paste away.
Does this generator send my rules anywhere?
No. Rules, hashes and downloads are all produced by JavaScript in the page. There is no server call and no stored history, so you can load the site, go offline, and keep working. The privacy policy spells out what that does and does not cover.
Is the password hash from this site safe to use?
Yes. It produces a salted APR1-MD5 line, the format htpasswd has always supported and Apache accepts everywhere. The password never leaves your browser. A fresh random salt is generated on every click, so the same password produces a different line each time, which is the format working as designed.
Still stuck?
Send the block and your Apache version to the address on the contact page. If a rule here is wrong, it is worth fixing for everyone.