An .htaccess file is a distributed configuration file that applies Apache HTTP Server directives to a specific directory. Its rules may also affect subdirectories, depending on the site’s hierarchy and the main server configuration.
The initial dot makes it a hidden file on Unix-like systems. It is not a universal web server technology or a method for shortening a URL. Its behavior depends on Apache, the installed modules, and the directives permitted by the server administrator.
Índice de contenidos
How .htaccess Works
When Apache receives a request, it may look for `.htaccess` files from higher-level directories down to the directory containing the requested resource. The applicable rules are combined along that path, so a file in one folder can affect that folder and the directories below it.
The AllowOverride directive in the main configuration determines whether Apache reads these files and which categories of instructions it accepts. `AllowOverrideList` can restrict permission to named directives. If the server uses `AllowOverride None`, the file is ignored even when it exists.
The instructions use the same general syntax as the main configuration, but not every directive is allowed in directory context. The result also depends on modules such as `mod_rewrite`, `mod_headers`, `mod_expires`, and `mod_authz_core`.
Common Directives
The file can address local requirements without changing the global configuration. Its common uses depend on the available permissions and modules:
- Redirects: Send a request to another address with the appropriate response code.
- Rewrites: Transform visible paths into internal paths processed by an application.
- Errors: Assign custom documents to responses such as a 404 Error.
- Caching: Define expiration headers for selected resource types.
- Compression: Enable response compression when the corresponding module is available.
It may also set MIME types, directory indexes, authentication, or headers. An `.htaccess` file does not activate these capabilities on its own: each valid directive requires the correct context, module, and permission.
URL Rewriting
The `mod_rewrite` module evaluates conditions and rules to change how a path is processed. An internal rewrite serves content from another location without changing the address shown by the browser. A redirect instead returns a response that sends the client to another URL.
This technical distinction matters when migrating pages, normalizing domains, or enforcing HTTPS. A 301 redirect communicates a permanent move, while other codes express different situations. The code should match the meaning of the change, not merely produce the expected destination.
Poorly ordered rules can create loops, chains, duplicate paths, or unexpected parameters. These effects hinder crawling, dilute signals, and increase response time. `.htaccess` can implement SEO decisions, but it does not replace planning for architecture or destination URLs.
Access Control
Apache can restrict resources by authentication, identity, host, or IP address. In Apache 2.4, the authorization system normally uses `Require` directives. The actual scope depends on the directory containing the file and any exceptions defined at lower levels.
Several different functions that are often confused should be separated when interpreting access rules:
- Authentication: Verifies identity through a configured provider.
- Authorization: Decides whether that identity may access the resource.
- IP filtering: Allows or denies requests based on the observed address.
- File protection: Prevents sensitive resources from being served from the public tree.
- Error pages: Presents a controlled response without correcting the cause of the failure.
Invalid syntax or a forbidden directive can produce a 500 Error. Hiding a file or blocking a path also does not repair application vulnerabilities. `.htaccess` is a configuration layer, not a complete security system.
Server Performance
When distributed files are enabled, Apache must check for their presence and read the applicable rules during requests. This repeated work adds overhead even when some directories contain no file. The impact can grow with the number of directory levels and rules evaluated.
When administrative access is available, Apache recommends placing directives in the main configuration, which is loaded when the server starts or reloads. `.htaccess` is most useful in managed hosting and environments where the content owner cannot edit that configuration.
Compression, caching, and efficient rules can support WPO, but the file does not guarantee a fast website. Servers such as Nginx and Microsoft IIS use other mechanisms, and some content management systems regenerate their rules. Any change must be assessed within the specific platform serving the requests.