Security

Common Apache blocks. Staging first. Not Nginx.

Toggle HTTPS, www vs apex, gzip, long cache, SPA index.html fallback, UTF-8, Options -Indexes, and blocks for .env / .git. Output is Apache 2.4 text. Missing mod_rewrite on a shared host is a 500. Merge carefully with WordPress / Laravel rules.

Required if you choose a canonical host redirect (www ↔ apex).

Test on staging. Enable mod_rewrite, mod_headers, mod_expires, mod_deflate, or mod_alias as noted in comments. WordPress and other apps may ship their own rules — merge carefully.

When to use this — and when not to

Use it on Apache 2.4 (or LiteSpeed in Apache-compat mode) when you want HTTPS, www/apex, gzip, cache, SPA fallback, UTF-8, -Indexes, or a conservative block of .env / .sql / .git.

Do not paste this onto Nginx or IIS. Do not drop it on top of WordPress / Laravel rewrites without merging. SPA fallback to index.html will swallow /api unless you add extra RewriteCond yourself.

What the generator actually emits

Concatenated Apache snippets with comments naming likely modules (mod_rewrite, mod_deflate, mod_expires, mod_headers). HTTPS + canonical host often means two 301 hops. Cache rules assume hashed CSS/JS filenames.

Worked example

Apex example.com, force HTTPS, apex canonical, SPA on:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTP_HOST} ^www\.example\.com$ [NC]
RewriteRule ^ https://example.com%{REQUEST_URI} [L,R=301]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.html [L]

Put that on staging. If you get 500, comment sections until it loads — missing mod_rewrite is the usual cause.

Mistakes people make

  • Long cache on unhashed app.js — users keep yesterday’s bundle.
  • SPA catch-all in front of PHP APIs.
  • Blocking .conf files the CMS actually serves.

Related

CORS headers · PWA manifest

Frequently asked questions

Nginx?

No. Native Nginx config, not this file.

HTTP 500 after paste?

Comment blocks until it boots. Check error logs for unknown directives.

WordPress already has rules?

Merge into one RewriteEngine block. Duplicates fight.

Is this uploaded?

No. Domain and toggles stay in the tab / localStorage.