Upgrowly
← Blog

.htaccess Guide: HTTPS, www, Redirects and Caching

By Neha

If your website sits on ordinary shared hosting, there is a small hidden file in its main folder that decides a surprising amount: whether visitors land on the secure https version, whether old links still work, and how fast your pages load on mobile data. That file is called .htaccess. Most owners never open it, and the ones who do often open it once, change one line and take the whole site down.

This guide explains what the file does, the four jobs most small business sites need from it, and how to edit it without fear.

Short answer: .htaccess is a settings file that Apache and LiteSpeed web servers read from your site's main folder. On shared hosting you use it to force https, pick one version of your address (www or without), send old pages to new ones with 301 redirects, and tell browsers to cache images. Always download a backup first, change one thing at a time, and put the backup back if you see a 500 error.

What is .htaccess, and does your hosting use it?

.htaccess is a plain text file of instructions for the web server, the computer that sends your pages to visitors. The dot at the start of the name makes it a hidden file, which is why many people cannot find it at first.

It only works on servers that read it. Apache reads it, and LiteSpeed is built to read the same file. Most Linux shared hosting sold in India uses one of the two. For example, the Linux plans from BigRock and GoDaddy come with cPanel, and Hostinger runs LiteSpeed with its own hPanel instead of cPanel. Nginx servers ignore .htaccess completely, so if your developer manages an Nginx server, these rules have to go into the server settings instead.

Not sure what your site runs on? The HTTP header checker shows the headers your server sends back, which often name the server software. If the file exists in your public_html folder and your site is WordPress, you are almost certainly on Apache or LiteSpeed.

How do you back up and edit .htaccess safely?

Download a copy before you touch anything, then make one change at a time and test after each one. That habit alone prevents nearly every .htaccess disaster.

  1. Log in to your hosting panel and open File Manager.
  2. Go to public_html, the main folder of your website. In cPanel, open Settings and turn on "Show Hidden Files (dotfiles)" if you cannot see .htaccess.
  3. Right-click .htaccess and download it. Rename the copy on your computer to something like htaccess-backup-19-oct.txt so you know what it is.
  4. Right-click the file on the server and choose Edit.
  5. Add your new rules at the top of the file. If you see a block between # BEGIN WordPress and # END WordPress, leave it exactly as it is. WordPress rewrites that part itself.
  6. Save, then open your site in a private browser window and click through four or five pages, including a product page and the contact form.

The .htaccess generator builds the rules below for you from a few tick boxes and explains each one in plain words. It wraps every block in a safety check, so if your host is missing a feature, that block is skipped instead of crashing the site.

How do you force HTTPS with .htaccess?

Add a rule that sends every http:// visit to the same page on https://. Your hosting must already have an SSL certificate installed, which most Indian hosts now include free.

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{HTTPS} off
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

In plain words: "If this visit is not secure, send it to the same address with https, and tell browsers the move is permanent." The R=301 part is the permanent redirect, and L means "stop here, this was the last rule needed".

Why bother? Browsers label plain http pages "Not secure", which puts people off filling in a contact form. Google also prefers the https version.

One warning for Cloudflare users. If Cloudflare's SSL mode is set to Flexible, Cloudflare talks to your server over plain http, your server redirects to https, and the visitor is caught in a loop. Cloudflare's own guide to redirect loops gives two fixes: remove the redirect from your server, or switch the SSL mode to Full or Full (strict).

Should you choose www or non-www?

Either is fine for Google. What matters is choosing one and redirecting the other to it, so you do not end up with two copies of the same site.

To Google, sharmadental.in and www.sharmadental.in are different addresses. If both open the site, links and shares get split between them. Pick whichever version already appears on your visiting cards and Google Business Profile, then redirect the other. This rule sends everything to https with www in a single hop:

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{HTTPS} off [OR]
  RewriteCond %{HTTP_HOST} ^sharmadental\.in$ [NC]
  RewriteRule ^ https://www.sharmadental.in%{REQUEST_URI} [L,R=301]
</IfModule>

If you prefer no www, flip it around:

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{HTTPS} off [OR]
  RewriteCond %{HTTP_HOST} ^www\.sharmadental\.in$ [NC]
  RewriteRule ^ https://sharmadental.in%{REQUEST_URI} [L,R=301]
</IfModule>

Use one of these instead of the separate HTTPS rule above, not as well as it. The backslash before each dot is deliberate: in these patterns a bare dot means "any character". After saving, run your address through the redirect chain checker. It tests all four versions of your address (with and without www, http and https) and shows whether each one reaches the right page, and in how many hops.

How do you set up a 301 redirect for one page?

Use one Redirect 301 line per page: the old path first, then the new address. Put these lines near the top of the file.

Redirect 301 /services.html /services/
Redirect 301 /diwali-offer-2025 /offers/
Redirect 301 /old-brochure.pdf /brochure/

A 301 tells browsers and Google that the page has moved for good, so most of the old page's standing passes to the new one. Say a CA firm in Lucknow renames "/gst-filing.html" to "/services/gst-return-filing/". Without a redirect, every WhatsApp forward and old Google result pointing at the first address now shows "page not found".

Three rules keep redirects healthy:

  • Send each old page to the closest matching new page, not to the home page.
  • Point straight at the final address. If A goes to B and B goes to C, change A to go to C.
  • Leave the redirect in place for good. Old links keep getting used for years.

Moving lots of pages at once? Paste the old and new addresses into the redirect generator. It writes the Apache lines for you and flags loops and chains before they go live. Our guide to finding and fixing broken links covers what to do with pages that are simply gone.

How do you add browser caching?

Tell visitors' browsers to keep images, styles and scripts for a long time, so a returning customer does not download your logo again on every visit.

<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresDefault "access plus 1 month"
  ExpiresByType text/html "access plus 0 seconds"
  ExpiresByType text/css "access plus 1 year"
  ExpiresByType application/javascript "access plus 1 year"
  ExpiresByType image/jpeg "access plus 1 year"
  ExpiresByType image/png "access plus 1 year"
  ExpiresByType image/webp "access plus 1 year"
  ExpiresByType image/svg+xml "access plus 1 year"
</IfModule>

The page itself (text/html) is never cached, so visitors always see your latest prices and timings. Everything else is kept for up to a year. If you replace an image, upload it under a new file name so browsers fetch the new one.

On a WordPress site, check first whether a caching plugin already adds these rules. Two sets of caching rules do no harm, but they make the file harder to read. Caching is only one part of speed, and our guide to improving website speed covers the rest, from image sizes to hosting.

What should you do if the site shows a 500 error?

Put your backup back straight away. A 500 Internal Server Error right after editing .htaccess almost always means one line in the file is wrong or not allowed on your hosting.

  1. Open File Manager again. It still works even when the site is down.
  2. Rename .htaccess to htaccess-broken. The server ignores a file with that name, so the site should come back within seconds.
  3. Upload your backup and rename it to .htaccess.
  4. Add your new rules back one block at a time, checking the site after each, until you find the one that breaks it.

The usual culprits are a typing mistake, a missing closing </IfModule> line, a feature your host has switched off, or an Options line your host does not allow inside .htaccess. If you see "too many redirects" instead of a 500, two rules are sending visitors back and forth, often your .htaccess and a plugin or Cloudflare setting doing the same job.

If none of that works, send the broken file and the backup to your hosting support. Most will read the error log for you. Our website security basics guide also covers why keeping backups of the whole site, not just this one file, saves you later.

Frequently asked questions

Where is the .htaccess file in cPanel?

It sits in public_html, the main folder of your website, but it is hidden by default. In cPanel's File Manager, open Settings at the top right and tick "Show Hidden Files (dotfiles)". If it still is not there, your site may not have one yet. You can create a new file with that exact name, starting with the dot.

Can a wrong .htaccess file hurt my Google ranking?

Yes, if it stays broken. A 500 error on every page means Google cannot read your site, and a wrong redirect can send all your pages to one address. Fixed within an hour or two, it rarely causes lasting harm. That is why you should check the site straight after every edit, in a private window.

Does .htaccess work on Hostinger?

Hostinger's tutorials, as of October 2026, say its hosting runs on LiteSpeed, which reads .htaccess files. You edit the file through File Manager in hPanel, inside public_html. Some of its agency plans switch .htaccess support off by default, with a setting to turn it on, so check that if your rules seem to be ignored.

Should I edit .htaccess or use a WordPress plugin?

For simple jobs such as forcing https or redirecting a few pages, either works. Plugins are safer if you are nervous, because a mistake rarely takes the site down. Editing .htaccess is faster and does not depend on WordPress loading first. Just avoid doing the same job in both places, which is the usual cause of redirect loops.

How do I check that my redirects are working?

Open the old address in a private browser window and see where you land. For a proper check, use a redirect checker, which shows every hop and its status code. You want a single 301 straight to the final page. A 302 means the move looks temporary to Google, and two or more hops mean you should point the first address straight at the last.