Questions tagged [.htaccess]

Directory-level configuration file found mostly on Apache web servers

The htaccess file is a supplemental configuration file used by Apache to modify the default configuration as it applies to the directory the htaccess file it in (as well as all the files and subdirectories in that directory).

You should avoid using .htaccess files completely if you have access to httpd main server config file. Using .htaccess files slows down your Apache http server. Any directive that you can include in a .htaccess file is better set in a Directory block, as it will have the same effect with better performance.
Source: Apache manual

The directives allowed in htaccess files are governed from the main Apache configuration files by means of the AllowOverride directive.

The most common use is in conjunction with the mod_rewrite and security modules of the Apache webserver. Mod_rewrite allows URLs to be rewritten for scenarios such as the following:

  • Shortcuts such as example.com/info to redirect to another page
  • Redirects from old pages to new pages
  • virtual directories (directories which actually appear elsewhere in the file system)

The most common security applications are:

  • Password protection of directories and files

For more information see the mod_rewrite and aaa documentation.

2807 questions
10
votes
2 answers

Allow using php_value and php_flag in .htaccess

I am running an Apache web server with PHP5 as a module (notice: as an Apache module, not CGI!). In some of my .htaccess files (the one that comes with the gallery3 software, http://gallery.menalto.com/), there are php_value and php_flag…
tvooo
  • 103
  • 1
  • 1
  • 5
10
votes
4 answers

Why do .htaccess redirects work in http but not with https?

I have a simple .htaccess file that works great on the http version of the site but not when I go to https. Why? RewriteEngine on #This is so if the file exists then use the file RewriteCond %{REQUEST_FILENAME} -f RewriteRule ^ %{REQUEST_FILENAME}…
Sheldon McGee
  • 441
  • 1
  • 7
  • 14
9
votes
1 answer

Why does my RewriteLog not work?

I have an .htaccess which looks like this: RewriteEngine on RewriteLog "/Applications/MAMP/logs/rewrite_engine_log" RewriteCond %{REQUEST_URI} !/(index.php|css|images|js)/.*$ RewriteRule (.*) /mysite/index.php/$1 When I add that RewriteLog…
openfrog
  • 235
  • 1
  • 4
  • 8
9
votes
2 answers

Can't figure out a htaccess rule

I have this in my htaccess but can't figure out what its for. Because of the nature of rule, searching doesn't help either. RewriteCond %{REQUEST_URI} !(/$|\.) RewriteRule (.*) %{REQUEST_URI}/ [R=301] Can anyone please explain what its for?
9
votes
1 answer

HSTS and double redirect

I manage a little website in a shared hosting LAMP environment: this basically means the only thing I can edit is an htaccess file. I wanted to add HSTS support (and I did it), but, when I tested my website here for HSTS preload eligibility, I got…
user487101
9
votes
2 answers

Apache Header Module Loaded but can't set headers in htaccess

I have Apache 2.2.29 (unix) setup and running on my new dev machine (mac). I am trying to set CORS headers for an API project - something that I have done many times. The htaccess file for the project looks like this:
Dan Lake
  • 91
  • 1
  • 1
  • 4
9
votes
2 answers

Dissecting a website attack through a compromised FTP account

My site has been hacked and at this point, I know some details, but I'm at a loss at exactly how it happened or how to prevent it in the future. I need your help in trying to dissect the attack so that I can prevent it from happening again. This is…
Dear Abby
  • 91
  • 2
9
votes
11 answers

.htaccess doesn't redirect to www-prefixed page properly

I'm trying to redirect an url without www. to www.version (example.com to www.example.com). I use the usual RewriteCond %{HTTP_HOST} ^example\.com [nc] RewriteRule (.*) http://www.example.com/$1 [R=301,L] This works on all my other projects.…
cypher
  • 91
  • 4
9
votes
5 answers

How to prevent hot linking ("image theft" / "bandwidth theft") of ressources on my site?

I'm trying to write the "ultimate" anti hot linking .htaccess... You can find many examples/tutorials/generators on the net but many of them are wrong or incomplete (or even both). These are the features I'm looking for: Must block hot linking for…
AlexV
  • 179
  • 1
  • 2
  • 16
9
votes
3 answers

How do I obscure my Wordpress install via htaccess?

(I am aware that security via obscurity is not recommended). I am trying to hide the fact that I am using Wordpress. This post is helpful, but it only addresses the content (sort of). I am interested in having the following occur: User tries to…
Son of the Wai-Pan
  • 757
  • 4
  • 11
  • 25
9
votes
3 answers

Limit upload file size and redirect user to error page if limit exceeds

Is it possible to redirect user to file file too big page when POST request size exceeds specified limit? I am aware about max-request-size option, but it gives just static page that cannot be overloaded. I am thinking to create a rewrite rule which…
jonny
  • 357
  • 1
  • 3
  • 15
8
votes
2 answers

.htaccess with single page website

I have a single page website with URL parameters that should still open the single index.html (made with Vue.JS and Vue.JS Router). For example, there is www.example.com/, www.example.com/user, and www.example.com/user/project/myproject. Now, as you…
M Zeinstra
  • 81
  • 1
  • 8
8
votes
2 answers

Invalid command 'AuthType', perhaps misspelled or defined by a module not included in the server configuration

I'm trying to password protect the document root and all I get is an "internal server error" page. The Apache error log shows: Invalid command 'AuthType', perhaps misspelled or defined by a module not included in the server configuration My…
Dean Or
  • 213
  • 1
  • 2
  • 5
8
votes
3 answers

Apache basic auth for a particular URL

I have a site in production that I want to modify (translate from French to English). The modified part will be placed in the domain.com/en URL location and I want to protect only this part with a basic HTTP auth during the modifications. I would…
Fabien Quatravaux
  • 273
  • 1
  • 2
  • 7
8
votes
1 answer

Create VHost & Forward subdomain to it

Gurus of So I have a simple .htaccess file where I only redirect non www to www for my webapp. Now what I want to do is Create a new vhost like http://subdomain.mydomain.tld Create a redirect for anybody coming to that subdomain to a folder on my…
iUsable