{{ summaryTitle }} {{ summaryValue }} {{ summaryLine }}

Profiles set useful defaults; every emitted feature remains visible below.
Use a bare host such as example.com; the generated sample never contacts it.
{{ issueFor('domain') }}
Choose only a hostname covered by DNS and the site certificate.
Enable only after the target host serves a valid certificate.
Use / for the document root or a leading-slash subpath such as /app/.
{{ issueFor('base_path') }}
{{ issueFor('cors_origin') }}
{{ issueFor('error_404') }}
{{ issueFor('redirect_rows') }}
{{ issueFor('blocked_ips') }}
{{ issueFor('maintenance_page') }}
{{ issueFor('php_settings') }}
{{ issueFor('mime_rows') }}
Turn this option on when directory listing is required.
{{ params.directory_listing ? 'Enabled' : 'Disabled' }}
Turn this option on when image hotlink protection is required.
{{ params.hotlink_protection ? 'Enabled' : 'Disabled' }}
Turn this option on when section comments is required.
{{ params.include_comments ? 'Enabled' : 'Disabled' }}
{{ values.config_text }}

The chart renderer is unavailable. The same readiness values remain in Review checks.

AreaCheckStatusEvidence and next actionCopy
{{ row.area }}{{ row.label }}{{ row.status }}{{ row.evidence }} {{ row.next_action }}
Rule familyStatePrimary directivesDeployment noteCopy
{{ row.label }}{{ row.state }}{{ row.directives }}{{ row.note }}
Apache Virtual Host Generator Draft an Apache virtual host for static files, PHP-FPM applications, or reverse proxies with TLS safeguards and activation checks.
.htaccess to Nginx Converter Convert a supported .htaccess subset into a reviewable NGINX draft with explicit warnings for unsupported or non-equivalent directives.
Nginx Server Block Generator Generate an NGINX server block for static sites, PHP-FPM apps, or reverse proxies with TLS routing plus safety and activation checks.
Hypertext Transfer Protocol (HTTP) Redirect Checker Trace a public HTTP redirect chain hop by hop to identify loops and HTTPS downgrades, compare timing and generate a replayable cURL command.

Apache can read per-directory configuration while serving a request. A file named .htaccess lets a site owner change behavior below one directory without editing the main server configuration. That makes it useful on shared hosting, but it also means a bad directive can turn every request in that directory into an HTTP 500 error.

The server decides which directives are allowed through AllowOverride and AllowOverrideList. With AllowOverride None, the file is ignored. A directive that needs an override class the host has not granted can fail even when the same syntax works in a virtual host. Loaded modules and the PHP handler add further differences between servers.

Situation Better home Reason
You administer the server Virtual host or main configuration Loaded once, easier to audit, and avoids per-request directory checks.
Managed hosting delegates one directory .htaccess Allows approved per-directory changes without root access.
A rule must protect the whole host Main configuration Central policy is harder for lower directories to override or omit.

Rule order matters. Redirects can run before application routing, a single-page application fallback can swallow a missing asset, and a maintenance redirect can loop when its own page is not excluded. Cache headers can keep a broken asset for a year, while a strict Content Security Policy can block the scripts or styles the site needs.

Transport and access settings need deployment context. HSTS is remembered by browsers and can include every subdomain. Wildcard cross-origin access is unsuitable for credentialed browser requests. IP blocking sees the connection address unless a trusted proxy configuration restores the real client address. Referer-based hotlink rules reduce casual embedding but do not form an authorization boundary.

A generated file should enter a staged test path, not go straight to a live document root. Confirm the target Apache version, override permissions, loaded modules, certificate coverage, application routes, response headers, error log, and rollback path before production use.

How to Use This Tool:

Build the smallest rule set the host actually supports, then review every warning against the deployment environment.

  1. Choose a Site profile, enter the canonical domain and base path, and decide whether host or HTTPS redirects belong at this layer.
  2. Select compression, caching, security headers, HSTS, directory listing, and any exact CORS origin. Treat strict CSP, preload HSTS, wildcard CORS, and immutable caching as review decisions.
  3. Add redirects as status /source target, IP or CIDR blocks, MIME overrides, or PHP settings only when the target host accepts those forms.
  4. Paste custom directives only from a trusted source. They are appended verbatim and are not checked for Apache semantics.
  5. Resolve Review checks, compare required modules with apachectl -M, run a server configuration test, and smoke-test representative URLs before replacing the active file.

Interpreting Results:

Ready for server checks means the draft passed local input and policy checks. It does not mean Apache accepted the directives. Review before upload means at least one selected option has a known deployment risk that needs a human decision.

The directive count and readiness profile are planning aids. The config text is the artifact Apache will read, while the review rows explain assumptions about modules, override classes, TLS, caching, CORS, PHP, maintenance routing, and custom rules. Test the config text even when every local check says Ready.

If deployment produces HTTP 500, restore the previous file first. Then inspect the Apache error log for the first unrecognized, disallowed, or malformed directive rather than changing unrelated rules.

Technical Details:

The draft targets Apache HTTP Server 2.4 per-directory syntax. Inputs are normalized and validated before directive families are assembled. A hostname is lowercased and stripped of a scheme, port, path, query, fragment, and trailing dots. Local paths must begin with / and contain no spaces, query text, or fragments.

Rule Core:

Order Rule family Mechanism Important condition
1Canonical routingRewriteCond and RewriteRuleHTTPS uses 301 or method-preserving 308; host-only canonicalization still points a noncanonical host to HTTPS.
2Site profileStatic index, SPA fallback, WordPress front controller, API front controller, or no preset rulesPer-directory rewrite patterns omit the leading URL slash.
3DeliveryCompression and browser-cache directivesBalanced assets use 30 days; immutable assets use 1 year and require fingerprinted URLs. HTML receives zero freshness.
4Response securityBaseline or strict headers plus optional HSTS and CORSStrict CSP and preload HSTS require application and domain-wide review.
5Access and errors404 document, IP denial, redirects, hotlink checks, directory indexes, and maintenance routingDirectory listing always emits either Options +Indexes or Options -Indexes.
6Runtime and customPHP values, MIME mappings, then trusted custom linesCustom lines are preserved exactly and placed last.

Transformation Core:

Each valid selection becomes a directive family with an enabled state, emitted lines, required-module clues, and a deployment note. Empty optional fields omit their family. Enabled families are joined in the fixed order above, with optional section comments. The final review status becomes review needed when any configured warning is present; warnings do not rewrite or remove the selected directive.

  • Redirect rows accept only 301, 302, 307, or 308 followed by a leading-slash source and one non-space target.
  • CORS accepts * or one exact HTTP or HTTPS origin without a path.
  • PHP rows must begin with php_value or php_flag; MIME rows require a media type and at least one extension.
  • IP validation accepts basic IPv4, IPv6, and CIDR-shaped tokens, but it is not a full network-address semantics check.

The required-module inventory is inferred from enabled families. It can identify likely dependencies such as rewrite, headers, expires, filter, deflate, Brotli, alias, or MIME support, but only the target server can prove that the modules are loaded and permitted in this directory.

Limitations and Safety Notes:

  • The generated draft does not know the active virtual host, inherited rules, proxy chain, PHP handler, module set, or effective AllowOverride policy.
  • Strict CSP may block legitimate resources. HSTS preload is difficult to reverse and affects included subdomains. One-year immutable caching can preserve stale files when URLs are not fingerprinted.
  • A maintenance redirect must exclude its own page and may still interfere with health checks, static assets, or operator access.
  • Processing occurs in the browser. Avoid pasting secrets into trusted custom rules, and review the downloaded file before moving it to a server.

References: