.htaccess Guide: Redirects, Rewrites, HTTPS Rules and Examples

What is .htaccess?

.htaccess is a per-directory Apache configuration file. It lets you apply rules to a website without editing the main Apache virtual host configuration. On shared hosting, reseller hosting and many cPanel servers, it is commonly used for redirects, rewrite rules, access control and cache or header tweaks.

Before editing .htaccess

Before adding new rules, check that you are editing the right file and that you can recover if something goes wrong.

cd /home/example/public_html
cp .htaccess .htaccess.bak.$(date +%F-%H%M)
ls -la .htaccess*

-rw-r--r-- 1 example example 2198 May 15 14:20 .htaccess
-rw-r--r-- 1 example example 2198 May 15 14:22 .htaccess.bak.2026-05-15-1422

After changing rules, test with curl -I. This shows the HTTP status and redirect target without loading the whole page.

curl -I https://example.com/old-page

301 redirect one old URL to a new URL

Use a 301 redirect when a page has permanently moved. This is useful for SEO because it points users and search engines to the preferred new URL.

RewriteEngine On

RewriteRule ^old-page/?$ /new-page [R=301,L]

Test it:

curl -I https://example.com/old-page

Expected output:

HTTP/2 301
location: https://example.com/new-page

Redirect an old .html URL to a clean URL

RewriteEngine On

RewriteCond %{THE_REQUEST} \s/+(.+?)\.html[\s?] [NC]
RewriteRule ^(.+?)\.html$ /$1 [R=301,L]

This redirects /about.html to /about only when the browser directly requests the .html version.

Force HTTPS

If your SSL certificate is installed and working, you can redirect HTTP requests to HTTPS.

RewriteEngine On

RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Test it:

curl -I http://example.com/

Expected output:

HTTP/1.1 301 Moved Permanently
Location: https://example.com/

Force www or non-www

You should choose one preferred host version. For example, use either example.com or www.example.com, not both.

Force non-www

RewriteEngine On

RewriteCond %{HTTP_HOST} ^www\.example\.com$ [NC]
RewriteRule ^ https://example.com%{REQUEST_URI} [R=301,L]

Force www

RewriteEngine On

RewriteCond %{HTTP_HOST} ^example\.com$ [NC]
RewriteRule ^ https://www.example.com%{REQUEST_URI} [R=301,L]

Test it:

curl -I https://www.example.com/blog

Expected output for non-www:

HTTP/2 301
location: https://example.com/blog

Serve clean URLs from PHP or HTML files

Clean URLs are easier to read and share. Instead of showing /blog.php, you can serve the same file from /blog.

RewriteEngine On

RewriteRule ^blog/?$ blog.php [L,QSA]
RewriteRule ^quizzes/?$ quizzes.php [L,QSA]
RewriteRule ^cheat-sheets/?$ cheat-sheets.php [L,QSA]

Test it:

curl -I https://example.com/blog

Expected output:

HTTP/2 200
content-type: text/html; charset=UTF-8

Fallback for real .html files

If you have files like grep-quiz.html but want /grep-quiz to work, use a careful fallback rule.

RewriteEngine On

RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME}.html -f
RewriteRule ^(.+?)/?$ $1.html [L]

Access control examples

Disable directory listing

This stops Apache from showing a list of files when a directory has no index file.

Options -Indexes

Block one IP address

<RequireAll>
    Require all granted
    Require not ip 203.0.113.10
</RequireAll>

Allow only one IP address

Require ip 203.0.113.10

Simple security headers

Some headers can be added from .htaccess if Apache has mod_headers enabled.

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

Test it:

curl -I https://example.com/

Expected output:

x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
referrer-policy: strict-origin-when-cross-origin

Troubleshooting .htaccess errors

If a rule breaks the site, check the HTTP status and Apache error log.

curl -I https://example.com/
tail -50 /usr/local/apache/logs/error_log

500 Internal Server Error

A 500 often means a syntax error, unsupported directive or invalid regular expression.

HTTP/2 500
content-type: text/html; charset=iso-8859-1

403 Forbidden

A 403 can be caused by access rules, directory listing being disabled, ModSecurity, file permissions or Apache trying to serve a directory instead of a rewritten file.

HTTP/2 403
content-type: text/html; charset=iso-8859-1

Too many redirects

This usually means two rules are fighting each other, such as forcing www and non-www at the same time.

curl -I -L https://example.com/old-page

For more command-line troubleshooting practice, see the Linux Troubleshooting Hub, the grep Command Builder and the dig Command Builder.

Useful .htaccess workflow

1. Back up the current file.
2. Add one rule at a time.
3. Test with curl -I.
4. Check for redirect loops.
5. Check Apache logs if you see 403 or 500 errors.
6. Only use 301 redirects when the move is permanent.
7. Keep specific rules above generic fallback rules.

You can also use the .htaccess Rule Builder to generate common snippets and then adapt them carefully.