Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any reason (security, performance, etc.) that I should not use .htaccess in an Apache production/live environment?

share|improve this question

Apache's official recommendation is to avoid use of .htaccess unless it's absolutely necessary.

If AllowOverride is set to anything other than None, then every single request that the system receives for a context with AllowOverride enabled will cause the Apache process to check for an .htaccess file in every part of the filesystem tree that could potentially contain a .htaccess that would apply to the current request.

See here:

In general, you should never use .htaccess files unless you don't have access to the main server configuration file. There is, for example, a prevailing misconception that user authentication should always be done in .htaccess files. This is simply not the case. You can put user authentication configurations in the main server configuration, and this is, in fact, the preferred way to do things.

.htaccess files should be used in a case where the content providers need to make configuration changes to the server on a per-directory basis, but do not have root access on the server system. In the event that the server administrator is not willing to make frequent configuration changes, it might be desirable to permit individual users to make these changes in .htaccess files for themselves. This is particularly true, for example, in cases where ISPs are hosting multiple user sites on a single machine, and want their users to be able to alter their configuration.

However, in general, use of .htaccess files should be avoided when possible. Any configuration that you would consider putting in a .htaccess file, can just as effectively be made in a section in your main server configuration file.

share|improve this answer

It depends on your requirements.

The technical reason for the existence of the .htaccess mechanism is so that people other than site administrators can change local configuration that they control without requiring access to the global apache server configuration.

It doesn't have a lot to do with security, but using many .htaccess files will impact performance.

share|improve this answer
How much is performance impacted? What sort of numbers would need to be reached for this performance hit to be visible? Link a source too if you can. – Tim Jan 13 '12 at 14:13
That's impossible to answer due to the infinite number of configurations possible, but I can guarantee you that there is a performance impact even if you have no htaccess files - apache still has to check for them. If you have enabled .htaccess for your entire documentroot, apache needs to do a stat(3) for every directory from the documentroot on down, and an fopen(3) call for every .htaccess file found. So retrieving /docroot/dir1/dir2/foo.html means apache may need to perform 6 filesystem operations and parse 3 .htaccess files, for every request to this resource. – adaptr Jan 13 '12 at 14:21
Your answer lead me to believe the performance impact would be noticeable. Sounds now like it is theory. – Tim Jan 13 '12 at 14:36
It is fact, as you can verify if you read the source code. – adaptr Jan 16 '12 at 8:06
Whether it is in the source code and whether the impact is significant enough to be measurable are different. As we're talking about read-only access, this should be entirely satisfiable from the system cache once it's read in the first time, shouldn't it? If so that would eliminate physical disk access. The rest is in-memory and not very strenuous. – thomasrutter Nov 28 '12 at 5:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.