What is .htaccess?

Code:: Htaccess

is short for Hypertext Access. It is a configuration file used by apache-based web servers.

Configuration files configure the initial settings of a program, or in this case the server. This means that the

Code:: .htaccess

file can be used to make the server behave in a certain way. Each function is basically just a line of text, or code, which tells the server what to do. You can add or change functionality by adding or changing the code in the .htaccess file.

What can I use .htaccess for?

There are a lot of possibilities with .htaccess, you can, for example, use it to:

Protect your site with a password.
Create a custom-made error page.
Redirect visitors to another page.

Common Usage

Authorization, authentication
A .htaccess file is often used to specify security restrictions for a directory, hence the filename "access". The .htaccess file is often accompanied by a .htpasswd file which stores valid usernames and their passwords.
URL rewriting
Servers often use .htaccess for rewriting long, overly comprehensive URLs to shorter and more memorable ones.
Blocking (access control)
Use allow/deny to block users by IP address or domain. Also used to block bad bots, rippers and referrers. Often used to restrict access by web crawlers.
SSI
Enable server-side includes.
Directory listing
Control how the server will react when no specific web page is specified.
Customized error responses
Changing the page that is shown when a server-side error occurs, for example HTTP 404 Not Found or, to indicate to a search engine that a page has moved, HTTP 301 Moved Permanently.
MIME types
Instruct the server how to treat different varying file types.
Cache control
.htaccess files allow a server to control caching by web browsers and proxies to speed up websites, reduce bandwidth usage, server load, and perceived lag. .htaccess also adds the cache age to the webpage resources so that on revisiting the page, the elements are reloaded from browser cache till the age mentioned expires, instead of requesting the resource again from the server.
HTTPS & HSTS
Implementation of both HTTPS and HSTS on Apache servers is largely dependent on correct URL rewriting & header information mentioned in .htaccess file. Any incorrect syntax in the file while deploying HTTPS or HSTS leads to a failure in implementation.

Advantages and Disadvantages

PROs

Immediate changes
Because .htaccess files are read on every request, changes made in these files take immediate effect – as opposed to the main configuration file which requires the server to be restarted for the new settings to take effect.
Non-privileged users
For servers with multiple users, such as on shared web hosting, it is often desirable to allow individual users the ability to alter their site configuration. The use of .htaccess files allows such individualization, and by unprivileged users – because the main server configuration files do not need to be changed.

CONs

Controlling Apache using the main server configuration file

Code:: httpd.conf

is often preferred for security and performance reasons:

Performance loss
For each HTTP request, there are additional file-system accesses for parent directories when using .htaccess, to check for possibly existing .htaccess files in those parent directories which are allowed to hold .htaccess files. It is possible to programatically migrate directives from .htaccess to httpd.conf if this performance loss is a concern.
Security
Allowing individual users to modify the configuration of a server can cause security concerns if not set up properly.[12]
Syntax
.htaccess is usually very sensitive to syntax errors. Due to this any misspellings may lead to server errors and web resources in the directory with the erroneous .htaccess not being displayed at all.

The format of .htaccess

The .htaccess file is a bit special because it begins with a dot. This means that in some FTP programs it is hidden and you generally cannot edit it on your computer without renaming it to for example htaccess.txt.