Apache · Configuration and operations
What is .htaccess and when should you avoid it?
Short answer
.htaccess is a per-directory configuration file Apache reads on every request when AllowOverride permits it. It is useful on shared hosting but adds latency and hidden configuration, so dedicated deployments should disable it.
When AllowOverride is not None, Apache checks each directory in the request path for an .htaccess file. Each file is parsed and merged into the request configuration, and parent directory settings can be overridden. That work happens per request, not once at startup.
<Directory "/var/www/app">
AllowOverride None
</Directory>
<Directory "/var/www/shared-hosting">
AllowOverride FileInfo AuthConfig Limit
</Directory>Why it costs you
- Filesystem stat and parse work on every request, even when the file has not changed
- Configuration is spread across the tree and easy to miss during reviews
- A writable .htaccess file can become a privilege or routing problem
- Rules can silently conflict with the main server configuration
- AllowOverride All exposes many directives that are hard to audit
On shared hosting you often have no choice, so restrict AllowOverride to the specific directive classes needed, keep files small and avoid rewrite rules that duplicate vhost configuration. On managed infrastructure, move the rules into the virtual host and set AllowOverride None.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1What does AllowOverride control?
- 2Why is .htaccess slower than vhost configuration?
- 3How would you migrate .htaccess rules into a virtual host?
- 4What are the security risks of a writable .htaccess file?
Say it in the interview
htaccess is per-directory configuration that Apache re-reads for each request when AllowOverride allows it. It is convenient for shared hosting but adds filesystem work and spreads configuration across the tree. On servers I control I set AllowOverride None and move rules into the vhost. If I must support it, I limit the allowed directive classes.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Apache mock interview and get scored feedback on depth, clarity and confidence.