mod_rewrite is a tiny language and most confusion comes from reading rules in isolation. Once you understand condition-then-rule and the flag letters, it clicks.

What you need: Apache with mod_rewrite enabled and a vhost that allows overrides.

Know the flags

L stops this round, QSA appends the existing query string, R issues a redirect, and NC makes matching case-insensitive. Most rules are a combination of these.

Rewrite conditions gate the rule

A RewriteCond only applies to the next RewriteRule. Use -f and -d to skip rules for real files and directories.

Redirect vs rewrite

Use a 301 redirect (R=301) when the URL should change in the browser; use an internal rewrite when the browser keeps the pretty URL and the server maps it behind the scenes.

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

How it works, in detail

mod_rewrite reads like a small state machine: conditions gate the next rule, and flags change how a match behaves. L stops the current pass, QSA appends the existing query string, and R turns an internal rewrite into a visible redirect. The distinction between rewrite and redirect matters for SEO, because a rewrite keeps the pretty URL while a 301 tells the browser and crawlers the URL changed. Most confusion comes from testing in a browser that caches redirects, so verify with curl and watch the actual status code.

Test every rule with curl -I and watch the status codes. A rewrite that “works” but returns the wrong code breaks SEO in ways you will not notice for months.