The recommendation from the Apache project is:
In general, you should only use .htaccess files when you don't have access to the main server configuration file. ... a common misconception is that user authentication and mod_rewrite directives must go in
So please both set
AllowOverride None and all your other directives in the main httpd.conf (and/or the subsections you
When Apache is not configured with
AllowOverride None you already occur a (minor) performance penalty, regardless of wether or not any
.htaccess files are used.
This because for each and every request apache will need to check for the presence of a potential
.htaccess file in every (sub-) directory leading down to the requested resource. For example when a file is requested out of a directory /www/htdocs/example, apache must look for the following files:
And so, for each file access out of that directory, there are 4 additional file-system accesses, even if none of those files are present. (If AllowOveride is set for /)
The system call used for that (
man 2 stat) by itself isn't that expensive and typically the file-system cache is used rather than polling the actual disk, limiting the actual IO requirements, but still it can add up, as this article argues.
When one or more actual
.htaccess files are actually present, apache still needs to
open and read it (triggering another IO read operation and usually also an IO write operation to update the filesystem
atime attribute) and parse it before the logic therein can be applied.
Unlike when your directives are in the main
httpd.conf, which only needs apache to parse them once, at startup, each
.htaccess file needs to be interpreted again for each and every request.
How expensive, in addition to the IO operations, parsing the .htaccess files is depends on their complexity.
That will take careful benchmarking to determine.