Htaccess redirect generator

Turn a list of old and new URLs into redirect rules for Apache, Nginx or IIS, with loops and open redirects refused before you deploy them.

1 · Your redirects

One per line: old path, then new

Separate them with a space, a comma or an arrow. Lines starting with # are ignored. Add a status code at the end of a line to override the default.

2 · Options

Default status

Server

Allow destinations on other domains

Off by default. An unintended off-site redirect is an open redirect, which is a real vulnerability and an easy typo.

3 · Configuration

Rules

This output is a server configuration file. Back up the existing one, test on a staging site first, and remember a 301 is cached hard by browsers — it is difficult to take back once visitors have it.

Paste the list, get the rules

One redirect per line. Old path first, then the new one, separated by a space, a comma or an arrow — whichever your list already uses. The same rules can be emitted as Apache .htaccess, an Nginx server block or an IIS web.config, so the output suits whoever runs the server.

What it refuses, and why

The output is a server configuration file. A mistake does not render badly, it takes a site down or sends visitors somewhere they should not go. So this refuses more than it accepts:

Off-site destinations are refused unless you deliberately turn them on. An unintended one is an open redirect, which is a real vulnerability and a plausible typo.
Only http and https. A javascript: or data: destination in a redirect is never legitimate.
Loops — a path redirecting to itself, or a cycle through several rules — are caught before you deploy them.
Chains are reported. If A goes to B and B goes to C, every visitor pays two round trips; point A at C.
Duplicates are flagged, because only the first rule for a path ever runs.
Line breaks in a path are refused outright — a field containing one could close the directive and append another.

Which status code

301 is permanent: browsers cache it hard and search engines pass ranking signals through it. Use it when the move is final, and be aware a cached 301 is difficult to take back. 302 is temporary. 307 and 308 are the same pair but preserve the request method, which matters for POST.

Why RedirectMatch and not RewriteRule

For a plain redirect, mod_alias is simpler and faster than the rewrite engine, and much harder to get wrong. The patterns are anchored and escaped, so /prices(new) is matched literally instead of becoming a capturing group that catches other URLs.

Limitations

These are exact-path redirects. Wildcard and pattern-based moves, query-string conditions and hostname redirects are not generated. Apache only reads .htaccess when AllowOverride permits it.