How to use
Paste httpd.conf, a VirtualHost or a .htaccess into “Check config” (or press “Try the sample”).
Under “Results”, read the syntax problems (unclosed or mismatched sections) and the points to check, with line numbers.
Under “Structure”, check how the sections nest and where each line is.
For redirects or HSTS, choose what to make in “Make .htaccess” and copy or save it.
Before applying, run apachectl configtest on your server.
What it does
Structure as a tree
Lists <VirtualHost>, <Directory>, <IfModule> and other sections with their nesting and line numbers.
Unclosed and mismatched sections by line
Flags opening tags with no close, closing tags with no opening tag, and closing tags whose name differs.
Overly open settings
Lists Options Indexes, ServerTokens and ServerSignature exposure, AllowOverride All and Require all granted at the root, following the Apache HTTP Server 2.4 documentation.
HTTPS redirect, HSTS and R=301
Points out a rewrite to https without the R flag, a missing HTTPS redirect and a missing HSTS header.
.htaccess snippets
Pick an HTTPS redirect, a www redirect (either direction), HSTS, security headers or caching.
Nothing is sent
The pasted config is processed only in your browser and is not sent to a server.
Use cases
- Check a WordPress .htaccess for directory listings or Apache version disclosure
- Write a 301 redirect from http to https in .htaccess
- Find a missing closing tag or old 2.2 syntax in a VirtualHost you received
- Check whether AllowOverride All or Require all granted is wider than needed
- Write a www-unifying redirect, HSTS and security headers
Capability matrix
| Feature | Support | Notes |
|---|---|---|
| Section tree, unclosed sections and mismatched closing tags | Supported | — |
| Checking whether a directive is in the main list | Partial | Covers the main core and common modules. A directive not in the list is shown as unknown, not as an error |
| Overly open settings (Indexes, ServerTokens, AllowOverride, Require all granted and others) | Partial | Based on patterns. It does not check whether a module is enabled |
| Whether an HTTPS redirect and HSTS are written | Partial | Only checks the text. Redirects at a load balancer or CDN in front are not visible |
| Reading files named by Include or IncludeOptional | Not supported | Only the paths are listed |
| A real syntax check with apachectl configtest | Not supported | Not run. Always check on your server before applying |
| Connecting to a server or checking real responses | Not supported | No network access |
| Converting to nginx, Caddy or other server configs | Not supported | Not supported |
Limits & notes
- Pasted input is limited to 300,000 characters, 20,000 directives and 64 nesting levels.
- Findings are a guide from tokens and structure. They can flag correct configs and miss problems.
- The directive list covers the main core and common modules. A directive not in the list is shown as unknown and is not judged wrong.
- Files named by Include or IncludeOptional are not read.
- The snippets are for .htaccess. Directives that only work in httpd.conf, such as ServerTokens, are not included.
- The HSTS snippet uses max-age=31536000 (one year) and includeSubDomains. preload is not included.
- The HTTPS redirect snippet redirects when %{HTTPS} is off. If a load balancer or CDN is in front, adjust it to match X-Forwarded-Proto or similar.
Privacy & safety
The pasted config, the findings and the generated snippets are processed only in your browser. They are never sent to or stored on a server.
FAQ
How do I write a .htaccess file correctly?
How do I redirect http to https in Apache?
Can it check that a VirtualHost is correct?
Are Apache 2.2 Order, Allow and Deny still usable?
Can it check nginx configs too?
Is the pasted config sent to a server?
Related tools
nginx Config Studio
Build a reverse proxy, SPA, PHP-FPM or HTTP-to-HTTPS redirect config from a form, or paste your nginx.conf to list syntax errors and easy-to-miss points. Everything runs in your browser and nginx is never executed.
Cache-Control Studio
Paste a Cache-Control header to see how long the browser and a CDN keep the response, and whether it must be revalidated before use. It flags contradictions such as no-store with max-age, and builds the header for common uses.
CSP Studio
Paste a Content-Security-Policy header or meta tag to see unsafe-inline, unsafe-eval, wildcards and missing object-src or base-uri, ranked high, medium or low, with a suggested policy. Generation and hash calculation are included.
.env Studio
Paste or drop a .env file to see its keys and values in a table, with duplicates, empty values and syntax problems flagged by line. Values are hidden by default. You can compare a .env with a .env.example, or export an example file, JSON or a Kubernetes Secret. It checks common dotenv syntax, not tool-specific rules such as docker compose variable expansion.
Caddyfile Studio
Paste a Caddyfile to see its site blocks, snippets ((name) and import) and matchers (@name) as a tree, with line-numbered findings for unbalanced braces and undefined references. You can also make reverse proxy, static site, SPA and www redirect templates.
Hosts Studio
Paste a hosts file to see its IP and host name pairs in a table, with format errors, duplicates and changed localhost lines flagged by line number. It checks the syntax of hosts entries (IP, whitespace-separated names, # comments). It does not resolve names or write to your system. Save the output file and place it in the system hosts location with administrator rights.
Last updated: