Getting the Most Out of .htaccess

A .htaccess file lets you configure Apache per directory without editing the main server config, and a handful of directives cover most needs. RewriteEngine On together with RewriteCond and RewriteRule powers pretty URLs and the near-universal HTTPS redirect: check %{HTTPS} off and 301-redirect to the same URL over HTTPS.

Beyond rewrites, ErrorDocument maps status codes to friendly pages, Header always set adds security headers like X-Content-Type-Options, and an AuthType Basic block with Require valid-user password-protects a directory (pair it with HTTPS so the credentials are encrypted). Two caveats: .htaccess is Apache-only — Nginx ignores it — and on Apache, rules in the main config are faster than .htaccess, which is read on every request. For shared hosting, though, .htaccess is the lever you have.