What Is an .htaccess File? Apache Guide and Examples

.htaccess File Banner

Quick answer: An .htaccess file lets an Apache HTTP Server apply supported configuration directives to a directory and its subdirectories, without editing the main server configuration. The host must allow the relevant overrides, and the required Apache modules must be enabled.

What an .htaccess file does

Apache reads a per-directory configuration file named .htaccess when the server is configured to allow it. Rules can apply to the directory containing the file and its descendants. A more specific nested file may add or override settings according to Apache's configuration rules.

When to use .htaccess

Use it when you need directory-level configuration but cannot edit the main server configuration. Common uses include redirects, custom error documents, access controls, and caching directives.

If you administer Apache, placing configuration in the main server or virtual-host configuration is usually preferable for performance and easier central management. Apache checks for .htaccess files during requests, and the server administrator may disable them entirely.

Create and configure an .htaccess file

  1. Confirm that the site runs Apache and that your host permits the directive you need in per-directory files.
  2. Create a plain-text file named exactly .htaccess and place it in the directory where the rule should apply.
  3. Check that required modules are enabled and the server's AllowOverride settings permit the directive. For mod_rewrite, Apache requires at least AllowOverride FileInfo or a matching AllowOverrideList.
  4. Back up the current file, add one change at a time, and confirm the site responds correctly. A syntax or rule error can cause server errors or unexpected redirects.

Apache .htaccess examples

Redirect one old page permanently

RewriteEngine On
RewriteRule ^old-page\.html$ /new-page.html [R=301,L]

In per-directory context, the matched path does not begin with a slash. Test redirects before using a permanent 301 rule in production.

Show a custom 404 page

ErrorDocument 404 /errors/404.html

The error document path is relative to the site's document root.

Require authentication for a directory

AuthType Basic
AuthName "Restricted Area"
AuthUserFile "/path/outside/public-root/.htpasswd"
Require valid-user

Use HTTPS for password-protected pages and store the password file outside the publicly served document root. Confirm the path and authorization configuration with your host.

Allow requests from one IP range

Require ip 192.0.2.0/24

This Apache 2.4 authorization example restricts access to the example network range. Replace it with the correct addresses and avoid locking yourself out.

Frequently asked questions

Why is my .htaccess file being ignored?

The server may disable overrides, the directive may not be allowed by AllowOverride or AllowOverrideList, or a required module may not be enabled. Ask the host or server administrator to check the configuration and logs.

Does .htaccess work on every web server?

No. It is an Apache HTTP Server feature. Other servers use different configuration systems, and some managed hosting platforms restrict or generate these settings for you.

For current details, read Apache's .htaccess tutorial, per-directory rewrite guide, and authentication guide.