Htaccess Toolkit

通过 Python 脚本为 Apache .htaccess 提供生成、lint、解释和预设查询：可生成 HTTPS 跳转、安全头、缓存、压缩、CORS、防盗链、错误页等规则，内置 10 条 lint 规则，支持 --strict 退出码与 JSON 输出；仅用 Python 标准库，无需网络。

charlie-morrison

热度 52.43

最近更新 2026-05-11 17:42:36

分类：开发依赖：代码执行 / 读写文件应用场景：代码生成 / 代码审查 / DevOps / 工作流 ...

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add htaccess-toolkit

Metadata

name: htaccess-toolkit
description: Generate, validate, lint, and explain Apache .htaccess files. Use when asked to create htaccess rules, redirect URLs, set security headers, enable caching, configure CORS, protect files, or audit existing .htaccess configurations. Triggers on "htaccess", "apache redirect", "mod_rewrite", "URL rewrite", "apache config", "browser caching", "hotlinking protection".

htaccess Toolkit

Generate, validate, lint, and explain Apache .htaccess files with security headers, caching, CORS, compression, and more.

Generate

# HTTPS redirect + security headers + compression
python3 scripts/htaccess.py generate --rewrites http-to-https --security strict --compression

# Full production setup
python3 scripts/htaccess.py generate \
  --rewrites http-to-https www-to-non-www \
  --security strict \
  --caching standard \
  --compression \
  --protect directory-listing dotfiles sensitive-files \
  --error-pages 404 500 \
  -o .htaccess

# WordPress hardening
python3 scripts/htaccess.py generate --protect wp-config xmlrpc dotfiles --security strict

# CORS for specific domain
python3 scripts/htaccess.py generate --cors specific --domain example.com

# Custom redirects
python3 scripts/htaccess.py generate --redirects "/old-page -> /new-page" "/blog -> https://blog.example.com"

# Hotlinking protection
python3 scripts/htaccess.py generate --protect hotlinking --domain example.com

Lint

# Basic lint
python3 scripts/htaccess.py lint .htaccess

# Strict mode (exit 1 on errors, CI-friendly)
python3 scripts/htaccess.py lint .htaccess --strict

# Filter by severity
python3 scripts/htaccess.py lint .htaccess --severity error warning

# JSON output
python3 scripts/htaccess.py lint .htaccess -f json

Lint Checks (10 rules)

rewrite-no-engine — RewriteRule without RewriteEngine On
duplicate-rewrite-engine — Multiple RewriteEngine On
redirect-no-slash — Redirect path not starting with /
missing-l-flag — RewriteRule without [L] flag
mixed-redirect-rewrite — Mixing Redirect and RewriteRule
unclosed-ifmodule — Unclosed IfModule blocks
unclosed-files — Unclosed Files/FilesMatch blocks
wildcard-cors — Wildcard origin with credentials
no-hsts — HTTPS without HSTS header
options-minus-indexes — Directory listing not disabled

Explain

# Human-readable explanation of each directive
python3 scripts/htaccess.py explain .htaccess

List Presets

python3 scripts/htaccess.py presets
python3 scripts/htaccess.py presets -f json

Available Presets

Rewrites: http-to-https, www-to-non-www, non-www-to-www, trailing-slash-add, trailing-slash-remove, remove-extension

Security: basic, strict

Caching: standard, aggressive

CORS: permissive, specific

Protection: directory-listing, dotfiles, sensitive-files, wp-config, xmlrpc, hotlinking

Error Pages: 404, 403, 500, 503