How to Configure AllowOverride in Apache and Enable .htaccess

Note: The screenshots in this article were captured in a Japanese-language Windows environment. Menu and setting names may differ slightly in an English-language installation.

If .htaccess is not being applied, check the AllowOverride setting in httpd.conf. However, the first thing you'll find in a search is often the AllowOverride None setting inside <Directory /> — do not change this to All. Apache's official documentation recommends keeping this block, which represents the entire filesystem, set to None, and instead allowing individual directories that actually use .htaccess.

In this article, using the Windows version of XAMPP as an example, we will explain how to check the target directory, set AllowOverride FileInfo or All, check the Apache syntax, restart, and test the operation.

Verification items	Content
Usage environment	Windows version XAMPP 8.2.12, Apache 2.4.58
configuration file	C:\xampp\apache\conf\httpd.conf
Main purpose	Enable URL rewriting via .htaccess

If you have not installed XAMPP, please check "How to install the Windows version of XAMPP" first. If you prefer to use a code editor to edit configuration files, you can also refer to How to install VSCode.

What is AllowOverride?

AllowOverride is the setting that specifies, per <Directory> block, which types of Apache directives are allowed to be used in .htaccess.

• AllowOverride None: .htaccess is not loaded
• AllowOverride All: Allow all directives available in .htaccess context
• AllowOverride FileInfo: Allow directives regarding URL rewriting, redirection, response information, etc.
• AllowOverride AuthConfig: Allow directives related to authentication/authorization
• AllowOverride Indexes: Allow directives regarding directory indexes

According to the Apache official AllowOverride documentation, setting All makes every directive available in .htaccess context. The basic approach is to specify only the type that suits your purpose, so you don't grant unnecessarily broad permissions.

Difference between AllowOverride All and FileInfo

RewriteEngine, RewriteCond, and RewriteRule, used for WordPress permalinks and general URL rewriting, are included in FileInfo. So if your purpose is just URL rewriting, the following setting is usually sufficient.

AllowOverride FileInfo

According to the Apache official mod_rewrite documentation, to use rewrite rules inside .htaccess, at least AllowOverride FileInfo or AllowOverride All is required.

On the other hand, if the CMS or app you're using writes multiple types of settings — authentication, Options, directory index, etc. — into .htaccess, you may need to use All, but only for the target directory.

purpose	Setting example
Don't use .htaccess	AllowOverride None
URL rewrite, redirect	AllowOverride FileInfo
Also uses Basic authentication	AllowOverride FileInfo AuthConfig
Multiple types of overrides required	AllowOverride All

Back up httpd.conf before configuration

The standard configuration file for the Windows version of XAMPP is located in the following location:

C:\xampp\apache\conf\httpd.conf

If you installed XAMPP in a different folder, read the actual installation location.

1. Open conf folder

In Explorer, open C:\xampp\apache\conf and make sure httpd.conf is there.

2. Create a backup

Before editing httpd.conf, copy it under a different name such as httpd.conf.bak. Save it somewhere you can restore it from if Apache no longer starts.

3. Open in text editor

Open httpd.conf in a text editor such as VSCode. If your environment requires administrator privileges when saving, please check the privileges before editing.

Directory root that should not be changed

If you search for AllowOverride None in httpd.conf, you may find the following block:

<Directory />
    AllowOverride None
    Require all denied
</Directory>

<Directory /> represents the filesystem root, not Apache's document root. This AllowOverride None is a safety setting that prevents Apache from searching for and applying .htaccess files anywhere that isn't explicitly allowed.

The Apache official AllowOverride documentation states that, for security and performance reasons, you should not set anything other than None in <Directory "/">, and should instead find or create a separate directory block to place your .htaccess-related settings in.

Therefore, we do not make the following changes:

# Bad configuration example：Do not target the entire file system
<Directory />
    AllowOverride All
    Require all denied
</Directory>

Also, do not change Require all denied.

Set AllowOverride to the target directory

1. Check DocumentRoot

Search within httpd.conf for DocumentRoot to find the folder where your web content is published. In a typical environment where XAMPP is installed to C:\xampp, the settings look like this.

DocumentRoot "C:/xampp/htdocs"
<Directory "C:/xampp/htdocs">
    # Check the settings in this block
</Directory>

Windows Explorer uses backslashes, but paths in Apache settings are written using forward slashes to match the existing notation.

2. Check the current AllowOverride

If the <Directory "C:/xampp/htdocs"> block already has AllowOverride All, no change is necessary. The content varies depending on the XAMPP version and existing settings, so it is not necessarily disabled in the initial state.

If the target block has AllowOverride None and you only want to use URL rewriting, change it to:

<Directory "C:/xampp/htdocs">
    Options Indexes FollowSymLinks Includes ExecCGI
    AllowOverride FileInfo
    Require all granted
</Directory>

3. Allow only specific sites

If multiple sites live under htdocs, you can limit the scope of the change by adding a block that targets only the site that needs it.

<Directory "C:/xampp/htdocs/example-site">
    AllowOverride FileInfo
    Require all granted
</Directory>

Only if you have confirmed that multiple types of overrides are required due to CMS specifications, block the target site as follows.

<Directory "C:/xampp/htdocs/example-site">
    AllowOverride All
    Require all granted
</Directory>

Please check the official requirements of the CMS or app you are using before changing to All.

Check Apache syntax and restart

After saving httpd.conf, check the syntax before restarting Apache. Run the following in a command prompt or PowerShell:

cd C:\xampp\apache\bin
.\httpd.exe -t

If the following is displayed, the configuration file syntax is correct.

Syntax OK

If you see an error, do not restart Apache — fix the file and line indicated in the message. If the problem cannot be resolved, restore httpd.conf from the backup.

After checking the syntax, execute Apache's "Stop" → "Start" in the XAMPP Control Panel. The changes to httpd.conf will take effect after restarting Apache.

Check the behavior of .htaccess

To check the URL rewriting, place the rules you'll actually use in .htaccess for the target site, and check whether the page is displayed at the expected URL. If RewriteRule isn't taking effect, check whether rewrite_module is loaded in httpd.conf.

LoadModule rewrite_module modules/mod_rewrite.so

If the line begins with #, it is commented out. However, before enabling the module, check your Apache configuration and app requirements. .htaccess is loaded on every request, so it's usually not necessary to restart Apache after changing it. On the other hand, if you change settings in httpd.conf or module settings, a restart is required.

Items to check if an error occurs

.htaccess is not reflected

• Does the <Directory> you configured match the actual path of .htaccess?
• Is a different value set in a parent or more specific <Directory> block?
• For URL rewriting, is at least AllowOverride FileInfo allowed?
• Is mod_rewrite loaded?
• Did you restart Apache after changing httpd.conf?

500 Internal Server Error

This could be a syntax error in .htaccess, a directive you're not allowed to use, or a required module not loaded. In a typical XAMPP environment, check the following logs:

C:\xampp\apache\logs\error.log

Check the settings that correspond to the message displayed — Invalid command, not allowed here, Options FollowSymLinks or SymLinksIfOwnerMatch is off, etc.

Apache doesn't start

First, check for syntax errors with .\httpd.exe -t. If it doesn't start immediately after editing, either revert your changes or restore httpd.conf from the backup you created.

Reference materials

• AllowOverride directive (Apache HTTP Server)
• Prerequisites for URL rewriting in .htaccess (Apache HTTP Server)
• Apache configuration file and .htaccess
• Apache security tips

Summary

Item	Recommended settings
<Directory />	Leave AllowOverride None as is; do not change
Sites that use URL rewriting	Set AllowOverride FileInfo on the target directory
Sites that require multiple types of overrides	Set AllowOverride All, limited to the target directory
Syntax check	C:\xampp\apache\bin\httpd.exe -t
Settings reflected	Restart Apache in XAMPP Control Panel
Error confirmation	C:\xampp\apache\logs\error.log

AllowOverride All is a setting that grants broad authority to .htaccess. Instead of changing the <Directory /> block you'll find first in a search, allow only the types you actually need on the directory where your site resides. If you only need URL rewriting, AllowOverride FileInfo is usually enough.