.htaccess basics – redirects, protection and caching

In short

The .htaccess is a text file in your website’s folder with which you give the Apache web server rules: redirects, access protection, caching, custom error pages. The Nexthosting web hosting platform uses Apache, so it works. A typo can bring down the whole site (error 500). Always make a copy first.

What is the .htaccess?

The name starts with a dot: it is a “hidden” file. It sits in the main directory of your website (where index.php is) and applies to that folder and all subfolders. Additional .htaccess files in subfolders apply to that part and override the one above it there.

• Display: switch on the display of hidden files in your SFTP program (“show hidden files”) or in the web panel’s file manager.
• Back up the file first: copy it as .htaccess-backup.
• Editing: use a plain text editor, not a word processor. Save as UTF-8 without BOM.

One faulty line = the whole website is down

Unknown directives lead to “500 Internal Server Error”. Change only one thing at a time, save, reload the page. If something goes wrong, restore the backup. Help: Error 500 and white page.

Structure and rules

# Comment: starts with a hash
Directive value
<IfModule mod_rewrite.c>
  RewriteEngine On
</IfModule>

• One directive per line.
• <IfModule …> only runs the rules if the module is present. This prevents 500 errors.
• Order matters: for redirects, specific rules come before general ones.
• With WordPress, the block sits between # BEGIN WordPress and # END WordPress. Put your own rules above or below it, never inside this block, because WordPress overwrites it.

Redirect http to https

Only once your certificate is active (SSL certificates).

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

If an intermediary (e.g. Cloudflare) runs in front of the server, %{HTTPS} can always be “off” and a loop results. In that case you check the X-Forwarded-Proto header:

RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

www or without www

Choose one main address.

Everything to without www

RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^(.*)$ https://%1/$1 [L,R=301]

Everything to www

RewriteEngine On
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteCond %{HTTP_HOST} ^(.+)$
RewriteRule ^(.*)$ https://www.%1/$1 [L,R=301]

Both variants must resolve in DNS (Connect a domain to your website) and be covered by the certificate.

301 redirects

Redirect 301 /alte-seite/ https://meinprojekt.de/neue-seite/
RedirectMatch 301 ^/blog/(.*)$ https://meinprojekt.de/ratgeber/$1

More in Error 404 and redirects.

Protect folders

Password protection

AuthType Basic
AuthName "Protected area"
AuthUserFile /path/to/.htpasswd
Require valid-user

The .htpasswd file contains encrypted passwords and lives outside the public folder. The web panel tells you the correct path, or you can find it via SSH with pwd. Password protection in the web panel is more convenient, if available.

Allow only certain addresses

Require ip 203.0.113.10

Do not show folder contents

Options -Indexes

Block files

# Block sensitive files
<FilesMatch "^(wp-config\.php|\.env|\.htaccess|readme\.html|license\.txt)$">
  Require all denied
</FilesMatch>

# Block backup and source files
<FilesMatch "\.(bak|sql|log|ini|sh|inc|swp|dist)$">
  Require all denied
</FilesMatch>

Do not block wp-config.php just because WordPress reads it internally: internal access is not affected, only requests through the browser.

Caching headers (browser cache)

With these rules the browser may store static files for a long time. That makes pages faster (Make your website faster, Understanding caching).

<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType image/webp "access plus 1 year"
  ExpiresByType image/avif "access plus 1 year"
  ExpiresByType image/jpeg "access plus 1 year"
  ExpiresByType image/png "access plus 1 year"
  ExpiresByType image/svg+xml "access plus 1 year"
  ExpiresByType font/woff2 "access plus 1 year"
  ExpiresByType text/css "access plus 1 month"
  ExpiresByType application/javascript "access plus 1 month"
  ExpiresByType text/html "access plus 0 seconds"
</IfModule>

<IfModule mod_headers.c>
  <FilesMatch "\.(css|js|webp|avif|jpg|jpeg|png|svg|woff2)$">
    Header set Cache-Control "public, max-age=31536000"
  </FilesMatch>
</IfModule>

If you change a file but keep the same name, visitors see the old version until it expires. In that case append a version number (style.css?v=2) or rename the file.

Compression (GZIP and Brotli)

Compressed files are smaller and load faster.

<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/css text/xml
  AddOutputFilterByType DEFLATE application/javascript application/json application/xml image/svg+xml
</IfModule>

Depending on the server configuration, compression (GZIP and in part Brotli) may already be switched on. Check first:

curl -sI -H "Accept-Encoding: gzip, br" https://meinprojekt.de/ | grep -i content-encoding

If content-encoding: gzip or br appears, you do not have to do anything. Brotli cannot be switched on from the .htaccess if the server does not offer it.

Error pages

ErrorDocument 404 /404.html
ErrorDocument 403 /403.html
ErrorDocument 500 /error.html

Security headers

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

More in Website security.

PHP values: better in the web panel

You can set PHP values in an .htaccess:

php_value upload_max_filesize 64M

This only works if PHP runs as an Apache module. In most modern hosting environments PHP runs as FPM, and then php_value and php_flag lines cause a 500 error. So change PHP settings in the web panel: PHP settings. Only there are the values also safeguarded by the plan limits.

Troubleshooting tips

Problem	Cause	Solution
500 after a change	Typo or unknown directive	Remove the last line
Rule has no effect	Wrong order, browser cache with 301	Test with curl, private window
Redirect loop	https detection behind a proxy	Check X-Forwarded-Proto
.htaccess disappears	WordPress/plugin overwrites it	Put your own rules outside the WordPress block
Access suddenly 403	Block in the file or a folder above	Check all .htaccess files in the path

Frequently asked questions

Does the .htaccess work at Nexthosting?

Yes. The web hosting platform uses Apache, and .htaccess is evaluated.

Does every website need an .htaccess?

No. Without the file the site runs with default behaviour. With WordPress it is created when you save the permalinks.

Where can I test rules safely?

On the preview address (<name>-<4 characters>.staging.nexthosting.app) or in a staging copy (Staging and cloning).

Further reading

• Error 404 and redirects
• SSL and mixed content
• Make your website faster
• File and folder permissions