Ten .htaccess rules worth knowing

Most of what a site's .htaccess file actually needs to do comes down to a small, repeated set of jobs — force HTTPS, pick one version of the domain, tidy up URLs, keep a folder private, stop something abusing your bandwidth. Here are ten rules that cover the overwhelming majority of real requests, with working syntax for each and a note on the one thing most likely to go wrong.

Before adding any of these, read how to use .htaccess if you have not already — in particular, keep a backup of the working file before you start, because a syntax mistake anywhere in it can return a 500 error for the whole site rather than just the new rule.

1. Force HTTPS

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Redirects any plain HTTP request to the same URL over HTTPS. Since every plan here includes SSL as standard, this is usually just a matter of turning it on rather than setting up a certificate first — see forcing HTTPS on your site for the panel-level alternative, which some platforms offer as a toggle instead of a manual rule.

2. Redirect www to non-www (or the reverse)

RewriteCond %{HTTP_HOST} ^www\.example\.com$ [NC]
RewriteRule ^(.*)$ https://example.com/$1 [R=301,L]

Picks one version of the domain and sends the other to it, which matters for SEO as much as tidiness — search engines treat www and non-www as different addresses unless you tell them otherwise. See www versus non-www for which one is worth choosing.

3. Redirect an old page to a new one

Redirect 301 /old-page.html /new-page

The simplest possible redirect, and the right tool when you have a small, known set of moved pages rather than a pattern to match.

4. Redirect a whole folder

RedirectMatch 301 ^/old-folder/(.*)$ /new-folder/$1

Sends every URL under /old-folder/ to the same path under /new-folder/, preserving whatever came after the folder name — useful after reorganising a section of a site rather than moving one page at a time.

5. Custom error pages

ErrorDocument 404 /errors/404.html
ErrorDocument 403 /errors/403.html

Replaces the server's bare default error page with one that matches your site and, ideally, offers a way back to somewhere useful. The path given is relative to the document root.

6. Block hotlinking of your images

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^https://(www\.)?example\.com/ [NC]
RewriteRule \.(jpg|jpeg|png|gif|webp)$ - [F,NC]

Stops other sites embedding your images directly and using your bandwidth to serve them. The empty referrer check in the second line allows requests with no referrer at all through, since some browsers and privacy tools strip it legitimately — without that line, direct image requests from apps and some browsers get blocked along with everything else.

7. Password-protect a directory

AuthType Basic
AuthName "Restricted area"
AuthUserFile /home/youraccount/.htpasswds/private/passwd
Require valid-user

Locks a specific folder behind a username and password, useful for a staging site or an admin tool you do not want indexed or publicly reachable. The password file itself must live outside the public web root — never inside the folder it is protecting, or a request could retrieve the password file directly.

8. Deny access to sensitive files

<FilesMatch "\.(env|log|ini|bak|sql)$">
    Require all denied
</FilesMatch>

Blocks direct browser requests to file types that should never be served publicly — environment files, logs, configuration backups, database dumps that were left in a web-reachable folder by accident. This is a safety net, not a substitute for simply not storing those files inside the public web root in the first place.

9. Turn off directory listing

Options -Indexes

Stops Apache showing a plain file listing when a folder has no index file — the difference between a visitor hitting a 403 and a visitor browsing every file in a folder that was never meant to be seen.

10. Clean URLs with a front controller

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php [QSA,L]

Sends every request that does not match a real file or folder to index.php, which is how most modern frameworks and CMS platforms turn a URL like /blog/my-post into something a single script can route internally. The two RewriteCond lines matter: without them, requests for genuine files — images, CSS, JavaScript — would also be routed through index.php instead of being served directly.

Getting the order right

Where more than one of these rules lives in the same file, order matters. Apache processes .htaccess top to bottom, and an early rule with the L flag stops later rules from running against that request at all. Put the most specific rules — an exact redirect for one URL — above general, pattern-matching rules like the front controller in example 10, or the specific rule may never get a chance to fire.

None of these ten rules is exotic — between them they cover almost every genuine .htaccess request that comes up on ordinary hosting. If you need something more specialised than this list, our fuller guide to using .htaccess covers the underlying syntax rules well enough to adapt one of these into what you actually need.