# Apache Config Studio

Paste .htaccess, httpd.conf or a VirtualHost to see its section tree and line-numbered findings: unclosed sections, unknown directives and overly open settings. You can also generate HTTPS redirect, www and HSTS snippets.

- URL: https://tools.itlibra.com/en/apache-config-studio
- On-device・No upload
- Last updated: 2026-10-26

## How to use

1. Paste httpd.conf, a VirtualHost or a .htaccess into “Check config” (or press “Try the sample”).
2. Under “Results”, read the syntax problems (unclosed or mismatched sections) and the points to check, with line numbers.
3. Under “Structure”, check how the sections nest and where each line is.
4. For redirects or HSTS, choose what to make in “Make .htaccess” and copy or save it.
5. Before applying, run apachectl configtest on your server.

## Use cases

- Check a WordPress .htaccess for directory listings or Apache version disclosure
- Write a 301 redirect from http to https in .htaccess
- Find a missing closing tag or old 2.2 syntax in a VirtualHost you received
- Check whether AllowOverride All or Require all granted is wider than needed
- Write a www-unifying redirect, HSTS and security headers

## What it does

### Structure as a tree

Lists \<VirtualHost\>, \<Directory\>, \<IfModule\> and other sections with their nesting and line numbers.

### Unclosed and mismatched sections by line

Flags opening tags with no close, closing tags with no opening tag, and closing tags whose name differs.

### Overly open settings

Lists Options Indexes, ServerTokens and ServerSignature exposure, AllowOverride All and Require all granted at the root, following the Apache HTTP Server 2.4 documentation.

### HTTPS redirect, HSTS and R=301

Points out a rewrite to https without the R flag, a missing HTTPS redirect and a missing HSTS header.

### .htaccess snippets

Pick an HTTPS redirect, a www redirect (either direction), HSTS, security headers or caching.

### Nothing is sent

The pasted config is processed only in your browser and is not sent to a server.


## Capability matrix

| Feature | Support | Notes |
| --- | --- | --- |
| Section tree, unclosed sections and mismatched closing tags | Supported | — |
| Checking whether a directive is in the main list | Partial | Covers the main core and common modules. A directive not in the list is shown as unknown, not as an error |
| Overly open settings (Indexes, ServerTokens, AllowOverride, Require all granted and others) | Partial | Based on patterns. It does not check whether a module is enabled |
| Whether an HTTPS redirect and HSTS are written | Partial | Only checks the text. Redirects at a load balancer or CDN in front are not visible |
| Reading files named by Include or IncludeOptional | Not supported | Only the paths are listed |
| A real syntax check with apachectl configtest | Not supported | Not run. Always check on your server before applying |
| Connecting to a server or checking real responses | Not supported | No network access |
| Converting to nginx, Caddy or other server configs | Not supported | Not supported |

## Limits & notes

- Pasted input is limited to 300,000 characters, 20,000 directives and 64 nesting levels.
- Findings are a guide from tokens and structure. They can flag correct configs and miss problems.
- The directive list covers the main core and common modules. A directive not in the list is shown as unknown and is not judged wrong.
- Files named by Include or IncludeOptional are not read.
- The snippets are for .htaccess. Directives that only work in httpd.conf, such as ServerTokens, are not included.
- The HSTS snippet uses max-age=31536000 (one year) and includeSubDomains. preload is not included.
- The HTTPS redirect snippet redirects when %{HTTPS} is off. If a load balancer or CDN is in front, adjust it to match X-Forwarded-Proto or similar.

## Privacy & safety

The pasted config, the findings and the generated snippets are processed only in your browser. They are never sent to or stored on a server.

## FAQ

### How do I write a .htaccess file correctly?

Paste a .htaccess into “Check config” to see its directives and line-numbered findings for unclosed sections and overly open settings. “Make .htaccess” gives templates for HTTPS redirect, www unification, HSTS, security headers and caching.

### How do I redirect http to https in Apache?

In .htaccess, use mod\_rewrite with RewriteCond %{HTTPS} off and RewriteRule ^ https://%{HTTP\_HOST}%{REQUEST\_URI} \[R=301,L\]. R=301 is a permanent redirect; R alone gives 302.

### Can it check that a VirtualHost is correct?

It checks matching open and close tags, unknown directives and sections, and overly open access. It does not check whether certificate files exist or whether ports overlap. Run apachectl configtest before applying.

### Are Apache 2.2 Order, Allow and Deny still usable?

Apache 2.4 uses Require (for example Require all granted). Order, Allow from and Deny from are reported as 2.2 syntax. mod\_access\_compat still loads in 2.4, but it is deprecated.

### Can it check nginx configs too?

No. This tool handles Apache only (httpd.conf, VirtualHost and .htaccess). Use nginx\_config\_studio for nginx.

### Is the pasted config sent to a server?

No. It is processed only in your browser and is neither sent nor stored.