Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Put the file named .htaccess in the subdomain’s document-root directory—the folder Apache serves for sub.example.com. Apache then applies permitted directives in that folder and its descendants. If the matching server configuration uses AllowOverride None, Apache ignores the file, so you must enable the override category required by your directives or place the rules in the virtual-host configuration instead.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What an .htaccess file does for a subdomain
An .htaccess file is Apache’s per-directory configuration mechanism. It lets a directory’s owner change selected server behavior without editing the main Apache configuration. For a subdomain, the important detail is that the file belongs in the directory mapped to that hostname, not automatically in the parent site’s public folder.
As an Amazon Associate I earn from qualifying purchases.
For example, a server might map play.example.com to /var/www/play and assets.example.com to /var/www/assets. A file at /var/www/play/.htaccess affects requests handled from the play subdomain and directories below it. A file at /var/www/.htaccess can be inherited by both only if the virtual-host and directory layout make that parent directory applicable.
Apache evaluates applicable parent-directory files and then more specific files as it resolves a request. A rule in the subdomain’s own directory can therefore refine or override inherited behavior, subject to Apache’s normal merge rules and the directives involved.
#1 Best Overall
Before you edit anything
Confirm that Apache is serving the subdomain
DNS alone does not identify the directory. The hostname must point to a virtual host (or an equivalent hosting-panel site) whose DocumentRoot is the directory you intend to change. If you have administrator access, inspect the virtual-host definition. On managed hosting, open the subdomain settings and note the displayed document root.
- Write down the exact hostname, such as
play.example.com. - Record the absolute document-root path, such as
/var/www/playor the path shown by the control panel. - Check whether the subdomain is a separate virtual host or merely a directory under the main site.
- Make sure your account can create hidden files and read the Apache error log, or know how to request those checks from the host.
Check the server’s override policy
Apache only reads an .htaccess file when the applicable <Directory> configuration permits it. With the default AllowOverride None, the file is ignored. The server administrator must enable the categories needed by your directives, or allow individual directives with AllowOverrideList.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall| Directive group | Required permission | Typical use |
|---|---|---|
FileInfo |
AllowOverride FileInfo (or a suitable AllowOverrideList) |
URL rewriting and other file-information controls, including RewriteEngine, RewriteCond and RewriteRule |
AuthConfig |
AllowOverride AuthConfig (or named directives in AllowOverrideList) |
Authentication directives such as AuthType, AuthName, AuthUserFile and Require |
None |
No overrides | Apache ignores directives in the file; this is a configuration decision, not a syntax problem in your file |
If you do not control the server configuration, ask the host to confirm both the document root and the permitted override categories. Do not assume that a host supporting .htaccess permits every directive.
Rank #2
- Used Book in Good Condition
Set up the file step by step
- Locate the document root. Use the virtual-host definition or hosting control panel to identify the directory assigned to the subdomain. Verify it by placing a harmless test file there and requesting it over the subdomain, then remove the test file.
- Create the file with the exact name. The filename is
.htaccess, including the leading dot and no extension. Upload it directly into the subdomain document root. Apache can use another filename only when the administrator changesAccessFileNamein the server configuration. - Set safe ownership and permissions. The Apache process must be able to read the file, while ordinary visitors must not be able to download its contents as a raw file. Use the ownership and permission pattern supplied by your host; do not make the file writable by every system user.
- Enable only the required override categories. For rewrite rules, the matching directory configuration needs the
FileInfocategory and themod_rewritemodule. For password protection, it needsAuthConfigand the relevant authentication modules. - Add one change at a time. Save a minimal rule, request one harmless URL, and check the response and error log. This isolates syntax errors, disallowed directives and interactions with parent files.
- Test both the subdomain root and a nested path. A rule can appear to work at
/while failing in a child directory, or vice versa. Test a normal page, a missing page and any path that the rule is intended to protect or redirect.
Rewrite URLs correctly in .htaccess context
Enable rewriting with RewriteEngine On. In per-directory context, Apache removes the directory prefix—and the leading slash—from the string matched by RewriteRule. Thus a request that appears in the browser as /guide/start is matched as guide/start in a file located at the document root. Examples copied from a virtual-host configuration often need this slash adjustment.
A minimal internal rewrite for a front controller could look like this:
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.+)$ index.php [L]The conditions leave existing files and directories alone, while the rule sends other paths to index.php. Adapt the target and flags to the application. If a parent directory already has rewrite rules, inspect their order before adding another set; an inherited rule may run first or alter the path you expect to match.
HTTPS redirect: use the deployment’s real signal
The goal of an HTTPS redirect is to send requests whose connection is not encrypted to the same host and path over HTTPS. The condition is deployment-specific. On a server that terminates TLS itself, Apache can normally inspect its HTTPS connection variable. Behind a reverse proxy or CDN, TLS may terminate before the request reaches Apache, and the backend connection can look HTTP even when the visitor used HTTPS. In that arrangement, use the proxy’s documented, trusted HTTPS header and configure the proxy so clients cannot spoof it; never copy a generic condition blindly.
A direct-to-Apache pattern is:
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]Use a temporary redirect while testing, then change to a permanent status only after confirming that the host, path and proxy behavior are correct. A malformed condition can create a redirect loop, and an untrusted host header can produce an unsafe redirect target. Many deployments instead hard-code the expected hostname.
Password-protect a subdomain or directory
Basic authentication is suitable for a small private area when it is carried over TLS. Place the following in the directory to protect:
AuthType Basic
AuthName "Restricted Files"
AuthUserFile "/path/outside/document-root/.htpasswd"
Require valid-userThe AuthUserFile path should be absolute and outside the document root, so a web request cannot retrieve the password database. Create the file with Apache’s supported password utility or your host’s control panel, then ensure the Apache process can read it while other users cannot.
The directory configuration must allow AuthConfig. If the prompt never appears, check that permission first, then verify the path and loaded authentication modules. Basic authentication sends credentials in a form that is not encrypted by itself; use mod_ssl and a working HTTPS connection before protecting anything confidential. A password prompt over plain HTTP is not adequate security.
Inheritance, scope and rule order
Apache searches applicable parent directories and combines their settings with the settings in the current directory. A site-wide or parent .htaccess can therefore affect the subdomain even when the subdomain has its own file. More-specific files are processed later, but not every directive can be overridden in the same way.
Best Value
- Used Book in Good Condition
- Look for parent rewrite rules that add, remove or redirect paths before your subdomain rule sees them.
- Check whether the subdomain is physically inside a parent directory covered by another
.htaccess. - Keep related rules together and document why a rule must precede or follow another rule.
- Use narrowly scoped conditions, such as a specific hostname or path, when inherited rules serve several sites.
- Do not assume that placing a second rule later cancels the first; some directives merge, while others replace or append behavior.
If you need predictable, host-wide behavior, move the configuration into the matching virtual-host or <Directory> block when you have administrative access.
Testing procedure that limits damage
- Save a copy of the working file before each edit.
- Start with a comment or a single harmless directive supported by the host.
- Request the subdomain root, a known existing file and a deliberately missing path.
- Inspect the HTTP status and the
Locationheader for redirects. Confirm that HTTPS redirects happen once and preserve the intended path. - Check Apache’s error log immediately after every change. Syntax errors and forbidden directives are usually reported there even when the browser shows only a generic server error.
- Test from a fresh browser session or with a command-line HTTP client so cached redirects and credentials do not hide a mistake.
- Remove the last change if the site returns an error, restore the previous copy, and then reintroduce the change in smaller pieces.
Do not use a permanent redirect during initial testing if you can avoid it; browsers may cache it and make a corrected rule appear broken.
Free tools Windows power users keep installed
One-click scans. No signup required.
Troubleshoot the failures you are most likely to see
The file has no effect
- Confirm that the file is in the actual document root for this subdomain, not the main domain’s root or a similarly named directory.
- Check that the file is really named
.htaccess; file managers often hide the leading dot or append.txt. - Ask the administrator whether the matching
<Directory>block usesAllowOverride None. - Verify that the request reaches Apache’s virtual host rather than another server or application.
The subdomain returns HTTP 500
- Read the Apache error log for the exact line and directive.
- Check the directive’s required override category; a syntactically valid directive still fails when it is disallowed.
- Look for unmatched quotes, misspelled flags, invalid regular expressions and unsupported modules.
- Restore the previous file, then add directives one at a time to identify the offending line.
A rewrite loops or points to the wrong path
- Remove the leading slash from the
RewriteRulepattern when the rule is in.htaccesscontext. - Review parent-directory rules and conditions that may run before the subdomain’s rules.
- Exclude the destination file or directory when an internal rewrite could match itself.
- Check whether a proxy’s scheme or host header causes an HTTPS condition to remain true after the redirect.
The password prompt fails
- Verify
AllowOverride AuthConfigfor the directory. - Check the absolute
AuthUserFilepath, spelling and file permissions. - Confirm that the authentication modules required by the host are loaded.
- Use HTTPS and test with a newly opened session to avoid stale credentials.
.htaccess versus main Apache configuration
Both approaches can produce the same behavior, but they suit different operating situations.
| Consideration | .htaccess | Virtual-host or server configuration |
|---|---|---|
| Access required | Directory or hosting-panel access may be enough | Root or administrator access is normally required |
| Where rules live | In the served directory and its descendants | In the virtual-host or <Directory> configuration |
| Performance | Apache checks for applicable files while handling requests | Configuration is loaded centrally, avoiding per-request directory-file checks |
| Security control | Permitted users can change server behavior within the allowed categories | Administrators retain centralized control over directives and scope |
| Provider support | Depends on AllowOverride or AllowOverrideList |
Available when the provider gives configuration access |
| Best fit | Managed hosting, control panels and sites whose owners lack root access | Servers you administer, especially when performance and centralized policy matter |
Apache recommends the main configuration when it is available because distributed files add directory checks and allow local users to modify behavior. Use .htaccess when the hosting model requires it or when delegating narrowly scoped directory settings is intentional.
Quick Recap
Operational and security checklist
- Use the exact subdomain document root and keep a backup of the last known-good file.
- Enable only the override categories and modules that the directives need.
- Keep
.htpasswdoutside every document root and protect its filesystem permissions. - Never rely on Basic authentication without HTTPS.
- Account for trusted reverse-proxy headers before writing scheme- or host-based redirects.
- Test redirects with temporary status codes before making them permanent.
- Monitor the Apache error log after each edit and remove a failing change immediately.
- Prefer virtual-host configuration when you administer the server and need centralized, predictable policy.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
