Free tool · Apache & LiteSpeed · Runs in your browser
.htaccess Speed & Security Generator
Pick the rules you need and copy a clean, commented .htaccess — compression, browser caching, HTTPS and security headers in seconds.
The preset turns on every rule that's safe for typical sites. HSTS stays off because it can't easily be undone — enable it only when HTTPS works everywhere.
Paste at the top of the .htaccess in your site's root folder (above # BEGIN WordPress on WordPress sites). Keep a backup of the old file first. The download is saved as htaccess.txt (browsers won't save files that start with a dot) — upload it and rename it to .htaccess.
Want the next level of speed?
Server-level caching beats .htaccess rules
These rules help browsers, but your server still builds every page. Hosts with LiteSpeed Cache, Varnish or Redis serve finished pages from memory — that's how TTFB drops from 800 ms to under 200 ms.
Hardening is step one
Already hacked, or not sure?
Malware often hides inside .htaccess — spam redirects, injected PHP and hidden backdoors that rules can't block. ToughProtection scans your site automatically and cleans it up for you.
Uploaded your new .htaccess? Test it.
Our speed test checks compression, caching headers and TTFB in about five seconds.
Frequently asked questions
What is an .htaccess file?+
It is a configuration file that Apache and LiteSpeed web servers read for each folder. It can turn on compression, set caching headers, redirect URLs and block access to files — without access to the main server config.
Where do I put these rules?+
Open the .htaccess file in your site's root folder (usually public_html) with cPanel File Manager or FTP and paste the rules at the very top. On WordPress, keep them above the # BEGIN WordPress block so WordPress never overwrites them.
Will this work on LiteSpeed and Nginx?+
Yes on Apache and LiteSpeed — LiteSpeed reads .htaccess natively. Nginx does not use .htaccess; its rules must go in the server block instead.
My site shows a 500 error after uploading — what now?+
Restore your backup .htaccess, then add the sections one at a time to find the rule your host does not support. Every section is wrapped in IfModule checks, so this is rare.
Is HSTS safe to enable?+
Only if every page and, with includeSubDomains, every subdomain works over HTTPS. Browsers remember HSTS for the full max-age, so mistakes are hard to undo — which is why the recommended preset leaves it off.