htaccess

htaccess is a per-directory configuration file used by the Apache HTTP Server to provide decentralized management of server settings. The file, named .htaccess, resides in a directory and contains directives that apply to that directory and its descendants. Apache reads the relevant .htaccess files during request processing, depending on the server’s AllowOverride configuration.

How it works: When a request arrives, Apache traverses from the document root to the requested directory, aggregating directives from any .htaccess files along the path that are allowed by AllowOverride. Changes take effect without restarting the server, though edits require re-reading the file for each request.

Common uses include access control and authentication, content negotiation, directory listing control, and URL manipulation via mod_rewrite. Typical directives found in .htaccess include AuthType, AuthName, AuthUserFile, Require for basic authentication; DirectoryIndex to choose a default file; Options to enable or disable features; and RewriteEngine, RewriteRule for URL rewrites. Modern Apache versions use the Require syntax (for example, Require all granted); older configurations may still use Order, Allow, and Deny.

Security and performance considerations: .htaccess enables flexible management, but it incurs per-request filesystem checks and parsing overhead. If possible, centralized configuration with AllowOverride disabled is preferred for performance. Protect sensitive files and ensure correct permissions so that the server can read the file but unauthorized users cannot access its contents. Always validate syntax with a config test after changes.