htaccess

If you are on a computer running Microsoft Windows create a text file named

htaccess.txt

paste the following into it:

{code type=php}
AddType application/x-httpd-php5 .html
AddType application/x-httpd-php5 .htm
{/code}

Upload the text file to your server. Once it has been uploaded, rename the file to

.htaccess

notice we have removed the “dot txt” extension and placed a “dot” in-front of the file name.

Once it has been renamed, load your website in your favorite browser. Now you can put php in html files!

The code you copied and pasted instructs the Apache server to parse the html document as though it where php.

The htaccess Beast

If your on a *nix box, no worries, but if you are doing this from a Windows Computer you need to name your file

{code type=php}htaccess.txt{/code}

so you can work with it, but after uploading it to your server, you will need to rename it to

{code type=php}.htaccess{/code}

notice the dot in-front and not at the end!!

Order Matters

First and foremost; order matters! First is First and Last is Last. If you deny access to something, later you cannot tell it what to do as it has already been blocked – make sense?

In other words this example will not work

{code type=php}#RewriteEngine On
#Options +FollowSymLinks
RewriteCond %{HTTP_USER_AGENT} ^WebCopier [NC]
RewriteRule ^.* – [F]{/code}

{code type=php}RewriteCond %{HTTP_USER_AGENT} ^WebCopier [NC]
RewriteRule (.*) naughty_robot.php
{/code}

Seems how we told that bot that it is forbidden to be here [F], we cannot tell it to go to a naughty robot page later in the script!

ReWrite Engine On

This needs to be at the top of the htaccess file, and only needs to appear  once

each of my examples will include this command, but it will be commented out because it only needs to be included once per htaccess file! So if you already have it turned on, then just leave the lines commented, or delete them.

But before we can begin dishing out rewrite commands, we need to make sure the rewrite engine is on.

{code type=php}RewriteEngine On
Options +FollowSymLinks{/code}

The first command is obvious – we are turning on the ReWrite engine. The second line is a bit fuzzy. It means that the ReWrite Engine should follow symbolic links – however, I have forgotten the true purpose of this line. You can comment it out with the hash (#) symbol and if you get a 500 error, you know you need it uncommented. It does not hurt to have it running at least as far as I recall. I always include it when using ReWrite anyways – just encase.

ReWrite Rule Format

A RewriteRule consists of three arguments separated by spaces. The arguments are

1. Pattern: which incoming URLs should be affected by the rule;
2. Substitution: where should the matching requests be sent;
3. [flags]: options affecting the rewritten request.

{code type=php}RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]

RewriteRule Tells the engine this is the rule to follow. The pattern is ^(.*)$ which is to be substituted with http://www.%{HTTP_HOST}/$1 and the flags are [R=301,L].

Pattern Matching

{code type=php}a+ matches “a”, “aaaa”, “aaaaaaaaaaaa”, but not “bbb”
[ab]+ matches, “a”, “b”, or any length combination of the two
\.s?html?> matches “.htm”, “.shtm”, “.html” or “.shtml”
(.+)/2010/(.+) matches “foo/2010/bar/”, and also stores “foo” in $1 and “bar/” in $2.
{/code}

htaccess Flags

[C] = Chain – if a rule matches, then processing continues as usual – the flag has no effect. If the rule does not match, then all following chained rules are skipped.

[F] = Forbidden – This forces the current URL to be forbidden – it immediately sends back a HTTP response of 403 (FORBIDDEN). Use this flag in conjunction with appropriate RewriteConds to conditionally block some URLs.

[G] = Gone – This forces the current URL to be gone – it immediately sends back a HTTP response of 410 (GONE). Use this flag to mark pages which no longer exist as gone.

[L] = Last Rule – Stop the rewriting process here and don’t apply any more rewrite rules. If you created a loop with ReWrite it will cause processing to be repeated starting from the first RewriteRule. The [L] flag terminates rewriterule processing only if the current rule is invoked.

[N] = Next – Re-run the rewriting process (starting again with the first rewriting rule). This time, the URL to match is no longer the original URL, but rather the URL returned by the last rewriting rule. Be careful not to create an infinite loop!

[NC] = No Case – This makes the Pattern case-insensitive, ignoring difference between ‘A-Z’ and ‘a-z’ when Pattern is matched against the current URL.

[OR] = Or – If it matches this condition or the next.

[R=code] = Redirect – If no code is given, a HTTP response of 302 (MOVED TEMPORARILY) will be returned. If you want to use other response codes, simply specify the appropriate number or use one of the following symbolic names: temp (default), permanent, seeother. Note: When you use this flag, make sure that the substitution field is a valid URL! Otherwise, you will be redirecting to an invalid location. Remember that this flag on its own will only prepend http://thishost[:thisport]/ to the URL, and rewriting will continue. Usually, you will want to stop rewriting at this point, and redirect immediately. To stop rewriting, you should add the ‘L’ flag.

[S=num] = Skip – This flag forces the rewriting engine to skip the next num rules in sequence, if the current rule matches. Use this to make pseudo if-then-else constructs: The last rule of the then-clause becomes skip=N, where N is the number of rules in the else-clause. (This is not the same as the ‘chain|C’ flag!)

[T=MIME-type] = Mime Type – Force the MIME-type of the target file to be MIME-type. This can be used to set up the content-type based on some conditions. For example, the following snippet allows .php files to be displayed by mod_php if they are called with the .phps extension:

{code type=php}RewriteRule ^(.+\.php)s$ $1 [T=application/x-httpd-php-source]{/code}

[PT] = Pass Through – This flag is just a hack to enable post-processing of the output of RewriteRule directives, using Alias, ScriptAlias, Redirect, and other directives from various URI-to-filename translators. For example, to rewrite /abc to /def using mod_rewrite, and then /def to /ghi using mod_alias:

{code type=php}RewriteRule ^/abc(.*) /def$1 [PT]
Alias /def /ghi{/code}

If you omit the PT flag, mod_rewrite will rewrite uri=/abc/… to filename=/def/… as a full API-compliant URI-to-filename translator should do. Then mod_alias will try to do a URI-to-filename transition, which will fail. Note: You must use this flag if you want to mix directives from different modules which allow URL-to-filename translators. The typical example is the use of mod_alias and mod_rewrite. The PT flag implies the L flag: rewriting will be stopped in order to pass the request to the next phase of processing.

Character Meanings

sources: http://httpd.apache.org/docs/2.2/rewrite/rewrite_intro.html, http://httpd.apache.org/docs/2.2/mod/mod_rewrite.html

Redirecting Non-WWW to WWW

{code type=php}#RewriteEngine On
#Options +FollowSymLinks
#FremontTech.com ReWrite NonWWW to WWW
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]{/code}

This will redirect any requests to http://yourwebsite.com to http://www.yourwebsite.com. Not only will it avoid duplicate content in Google, but it will also avoid the possibility of a split page rank and/or split link popularity.

Redirecting WWW to Non-WWW

{code type=php}#RewriteEngine On
#Options +FollowSymLinks
#FremontTech.com ReWrite WWW to NonWWW
RewriteCond %{HTTP_HOST} !^yourwebsite\.com$ [NC]
RewriteRule ^(.*)$ http://yourwebsite.com/$1 [R=301,L]{/code}

This will redirect any requests to http://www.yourwebsite.com to http://yourwebsite.com. Not only will it avoid duplicate content in Google, but it will also avoid the possibility of a split page rank and/or split link popularity.

Block Viewing Directory

{code type=php}#FremontTech.com Block Open Directories
Options -Indexes{/code}

This will keep people from walking all over your server, easily downloading files, and easily saving images.

Block Specific File Types

{code type=php}#FremontTech.com Block Specific File Types
Order allow,deny
Deny from all
Satisfy all
{/code}

Block Specific File Types #2

{code type=php}# FremontTech.com Deny Access to ALL .log and .comment Files

Order allow,deny
Deny from all
Satisfy All
{/code}

Deny Access based on Referrer

{code type=php}#FremontTech.com Deny Access Based On Referrer
RewriteCond % BadWebSiteAddressHere\.com [NC]
RewriteRule .* – [F]{/code}

However, this is not fool proof – infact – its kind of silly. If the User Agent drops (or hides) the referrer string – this code is useless.

Deny Access based on IP

{code type=php}#FremontTech.com Deny Access Based On IP
order allow,deny
deny from 123.123.123.123
allow from all{/code}

I use the reverse of this quite often when building websites.

Allow Access based on IP

{code type=php}#FremontTech.com Allow Access Based On IP
order allow,deny
allow from 123.123.123.123
deny from all{/code}

-or-

{code type=php}#FremontTech.com Allow Access Based On IP
RewriteCond % !^123\.123\.123\.123$
RewriteRule ^/?$ http://www.google.com/ [R=301,L]{/code}

Redirect Specific Pages

{code type=php}#FremontTech.com Redirect Specific Pages
Redirect /Old.htm /New.htm{/code}
{code type=php}#FremontTech.com Redirect Specific Pages
Redirect /Old.htm http://www.yoursite.com/New.htm{/code}