Force www in a Generic Way  Copy Section

This works for _any_ domain. Source
Force non-www  Copy Section

It’s still open for debate whether www or non-www is the way to go, so if you happen to be a fan of bare domains, here you go:

Force non-www in a Generic Way  Copy Section

Force HTTPS  Copy Section

Force HTTPS Behind a Proxy  Copy Section

Useful if you have a proxy in front of your server performing TLS termination.

Force Trailing Slash  Copy Section

Remove Trailing Slash  Copy Section

This snippet will redirect paths ending in slashes to their non-slash-terminated counterparts (except for actual directories), e.g. https://www.example.com/blog/ to https://www.example.com/blog. This is important for SEO, since it’s recommended to have a canonical URL for every page.

Source
Redirect a Single Page  Copy Section

Source
Redirect Using RedirectMatch  Copy Section

Source
Alias a Single Directory  Copy Section

Alias Paths to Script  Copy Section

This example has an index.fcgi file in some directory, and any requests within that directory that fail to resolve a filename/directory will be sent to the index.fcgi script. It’s good if you want baz.foo/some/cool/path to be handled by baz.foo/index.fcgi (which also supports requests to baz.foo) while maintaining baz.foo/css/style.css and the like. Get access to the original path from the PATH_INFO environment variable, as exposed to your scripting environment.

This is a less efficient version of the FallbackResource directive (because using mod_rewrite is more complex than just handling the FallbackResource directive), but it’s also more flexible.
Redirect an Entire Site  Copy Section

This way does it with links intact. That is www.oldsite.com/some/crazy/link.html will become www.newsite.com/some/crazy/link.html. This is extremely helpful when you are just “moving” a site to a new domain. Source
Alias “Clean” URLs  Copy Section

This snippet lets you use “clean” URLs -- those without a PHP extension, e.g. example.com/users instead of example.com/users.php.

Source
Exclude URL from Redirection  Copy Section

This snippet allows you to exclude a URL from redirection.  For example, if you have redirection rules setup but want to exclude robots.txt so search engines can access that URL as expected.

Security  Copy Chapter

Deny All Access  Copy Section

But wait, this will lock you out from your content as well! Thus introducing...
Deny All Access Except Yours  Copy Section

xxx.xxx.xxx.xxx is your IP. If you replace the last three digits with 0/12 for example, this will specify a range of IPs within the same network, thus saving you the trouble to list all allowed IPs separately. Source
Now of course there's a reversed version:
Allow All Access Except Spammers'  Copy Section

Deny Access to Hidden Files and Directories  Copy Section

Hidden files and directories (those whose names start with a dot .) should most, if not all, of the time be secured. For example: .htaccess, .htpasswd, .git, .hg...

Alternatively, you can just raise a “Not Found” error, giving the attacker no clue:

Deny Access to Backup and Source Files  Copy Section

These files may be left by some text/HTML editors (like Vi/Vim) and pose a great security danger if exposed to public.

Source
Disable Directory Browsing  Copy Section

Disable Image Hotlinking  Copy Section

Disable Image Hotlinking for Specific Domains  Copy Section

Sometimes you want to disable image hotlinking from some bad guys only.

Password Protect a Directory  Copy Section

First you need to create a .htpasswd file somewhere in the system:

Then you can use it for authentication:

Password Protect a File or Several Files  Copy Section

Block Visitors by Referrer  Copy Section

This denies access for all users who are coming from (referred by) a specific domain.
Source

Block Specific User Agents  Copy Section

This will block specific user agents from accessing your site, useful for blocking scrapers and bad bots.

Prevent Framing the Site  Copy Section

This prevents the website to be framed (i.e. put into an iframe tag), when still allows framing for a specific URI.

Content Security Policy (CSP)  Copy Section

A Content Security Policy header helps mitigate cross-site scripting (XSS) and other code injection attacks by declaring which dynamic resources are allowed to load.

Adjust the directives to fit your needs. See the CSP reference for all available directives.
Prevent MIME Type Sniffing  Copy Section

This prevents browsers from trying to guess ("sniff") the MIME type of a resource, which can have security implications. The browser will trust what the server says and block the resource if it doesn't match the expected type.

Set Referrer Policy  Copy Section

Control how much referrer information is included with requests. This helps protect user privacy by preventing the full URL from leaking to external sites.

Set Permissions Policy  Copy Section

Restrict which browser features your site can use, such as camera, microphone, geolocation, etc.

Remove Server Signature  Copy Section

Prevent Apache from exposing its version number and OS information in HTTP headers and error pages.

Performance  Copy Chapter

Compress Text Files  Copy Section

Source

Set Expires Headers  Copy Section

_Expires headers_ tell the browser whether they should request a specific file from the server or just grab it from the cache. It is advisable to set static content's expires headers to something far in the future.
If you don’t control versioning with filename-based cache busting, consider lowering the cache time for resources like CSS and JS to something like 1 week. Source

Set Cache-Control Headers  Copy Section

Cache-Control headers provide more fine-grained control over browser caching than Expires headers. You can use both together for maximum compatibility.

Turn eTags Off  Copy Section

By removing the ETag header, you disable caches and browsers from being able to validate files, so they are forced to rely on your Cache-Control and Expires header. Source

Miscellaneous  Copy Chapter
Set PHP Variables  Copy Section

Custom Error Pages  Copy Section

Custom Maintenance Page  Copy Section

Redirect all traffic to a maintenance page while still allowing access from a specific IP address.

Replace xxx.xxx.xxx.xxx with your IP address to retain access while the site is under maintenance.
Force Downloading  Copy Section

Sometimes you want to force the browser to download some content instead of displaying it.

Now there is a yang to this yin:
Prevent Downloading  Copy Section

Sometimes you want to force the browser to display some content instead of downloading it.

Allow Cross-Domain Fonts  Copy Section

CDN-served webfonts might not work in Firefox due to CORS. This snippet solves the problem.

Source
Enable CORS  Copy Section

Enable Cross-Origin Resource Sharing (CORS) for your site, allowing other domains to make requests to your server.

To restrict access to specific domains, replace * with the domain, e.g. https://example.com.
Auto UTF-8 Encode  Copy Section

Your text content should always be UTF-8 encoded, no?

Source
Set Custom MIME Types  Copy Section

Define custom MIME types for file formats that Apache may not recognize by default.

Switch to Another PHP Version  Copy Section

If you’re on a shared host, chances are there are more than one version of PHP installed, and sometimes you want a specific version for your website. The following snippet should switch the PHP version for you.

Serve WebP/AVIF Images  Copy Section

If a modern format image (AVIF or WebP) with the same name exists alongside the original jpg/png, it will be served instead. AVIF is preferred over WebP when the browser supports both.