20+ .htaccess Hacks Every Web Developer Should Know About
Apache’s .htaccess(hypertext access) configuration file can be a very powerful tool in a web developer’s toolkit if used properly. It can be found in the webroot of your server and can be easily edited using any text editor. In this article I’m going to show you 20 .htaccess hacks and how to use them.
Before I start with this article I’d like to start by saying that abusing the .htaccess file will hurt the performance of your website. The .htaccess file should only be used if you have no other way to achieve certain things.
Make sure to back up your current .htaccess file before applying any of the following hacks.
1. Prevent Hotlinking
Tired of people using your bandwidth by putting the images hosted on your server on their website? Add the following code at the bottom of your .htaccess file to prevent hotlinking.
1 |
Options +FollowSymlinks |
2 |
#Protect against hotlinking |
4 |
RewriteCond %{HTTP_REFERER} !^$ |
5 |
RewriteCond %{HTTP_REFERER} !^http://(www.)?domainname.com/ [nc] |
NOTE: The following article explains better methods to “prevent” hotlinking:
Link building secrets by Maurizio Petrone
2. Block All Requests From User Agents
It’s possible to block all unwanted user agents that might be potentially harmful or perhaps just to keep the server load as low as possible.
02 |
SetEnvIfNoCase user-Agent ^FrontPage [NC,OR] |
03 |
SetEnvIfNoCase user-Agent ^Java.* [NC,OR] |
04 |
SetEnvIfNoCase user-Agent ^Microsoft.URL [NC,OR] |
05 |
SetEnvIfNoCase user-Agent ^MSFrontPage [NC,OR] |
06 |
SetEnvIfNoCase user-Agent ^Offline.Explorer [NC,OR] |
07 |
SetEnvIfNoCase user-Agent ^[Ww]eb[Bb]andit [NC,OR] |
08 |
SetEnvIfNoCase user-Agent ^Zeus [NC] |
09 |
<limit get="" post="" head=""> |
3. Redirect Everyone Except Specified IPs
If for some reason you would want to deny everyone or allow only a specific group of IP addresses to access your website, add the following code to your .htaccess file:
4 |
Allow from 124.34.48.165 |
5 |
Allow from 102.54.68.123 |
4. SEO Friendly 301 Redirects
If you’ve transferred domain names or wish to redirect a specific page or pages without getting penalty from search engines such as Google, use the following code:
5. Creating a Custom Error Page
Are you as tired as me of the default layout of 404 error pages? Well now you can easily create your own and refer to it like this:
1 |
ErrorDocument 401 /error/401.php |
2 |
ErrorDocument 403 /error/403.php |
3 |
ErrorDocument 404 /error/404.php |
4 |
ErrorDocument 500 /error/500.php |
6. Create an IP Banlist
Tired of getting the same bs comments specific user over and over again? Just ban the bastard like this by adding the following code to your .htaccess file:
2 |
deny from 145.186.14.122 |
7. Set Default Email Address For Server Admin
Using the following code you can specify the default email address for the server’s admin.
2 |
SetEnv SERVER_ADMIN default@domain.com |
8. Disable Display of Download Request
Usually when downloading something from a web site, you’ll be prompted if you wish to open the file or save it on your hard-disk. To prevent the server from prompting users wether they wish to open or save the file and to just save the file, use the following code:
1 |
AddType application/octet-stream .pdf |
2 |
AddType application/octet-stream .zip |
3 |
AddType application/octet-stream .mov |
9. Protect a Specific File
The following code allows you to deny access to any file you wish by throwing an 403 error when it is trying to be accessed. In the following example I’ve chosen to protect the .htaccess file by adding an extra layer of security.
1 |
#Protect the .htaccess File |
10. Compress Components With mod_deflate
As an alternative to compressing files with Gzip, you can use mod_deflate(which is supposively faster). Place the following code at the top of your .htaccess file(tip: you can also add .jpg|.gif|.png|.tiff|.ico mod_deflate those):
1 |
<ifmodule mod_deflate.c=""> |
2 |
<filesmatch .(js|css)$=""> |
3 |
SetOutputFilter DEFLATE |
11. Add Expires Headers
The following code shows you how to add an expiration date on the headers.
1 |
<filesmatch .(ico|pdf|flv|jpg|jpeg|png|gif|swf)$=""> |
2 |
Header set Expires "Wed, 21 May 2010 20:00:00 GMT" |
12. Setting the Default Page
You can set the default page of a directory to the page of your choice. For example in this code the default page is set as about.html instead of index.html
1 |
#Serve Alternate Default Index Page |
2 |
DirectoryIndex about.html |
13. Password Protect Your Directories and Files
You can enable password authentication for any directory or file on your server by using the following code:
01 |
#password-protect a file |
05 |
AuthUserFile /home/path/.htpasswd |
09 |
# password-protect a directory |
12 |
AuthName "This directory is protected" |
13 |
AuthUserFile /home/path/.htpasswd |
14 |
AuthGroupFile /dev/null |
14. Redirect an Old Domain to a New Domain
By using the .htaccess file you can redirect a old domain name to a new domain by adding the following code into the htaccess file. Basically what it does is it will remap the old domain to the new one.
1 |
#Redirect from an old domain to a new domain |
15. Force Caching
The following code will not directly increase the loading speed of your website. What it will do is, load the content of your site faster when the same user revisits your website by sending 304 status when requested components have not been modified. You can change the cache expiry by changing the number of seconds(it’s currently set at 1 day).
3 |
ExpiresDefault "access plus 86400 seconds" |
16. Compress Components By Enabling Gzip
By making use of Gzip you can compress files in order to make your website load faster.
1 |
AddOutputFilterByType DEFLATE text/html text/plain text/xml application/xml application/xhtml+xml text/javascript text/css application/x-javascript |
2 |
BrowserMatch ^Mozilla/4 gzip-only-text/html |
3 |
BrowserMatch ^Mozilla/4.0[678] no-gzip |
5 |
BrowserMatch bMSIE !no-gzip !gzip-only-text/html |
17. Remove “category” from a URL
To transform this url: http://yourdomain.com/category/blue to -> http://yourdomain.com/blue, just add the following code at the bottom of your .htaccess file.
18. Disable Directory Browsing
To prevent people from accessing any directories that might contain valueble information or reveal security weaknesses(e.g. plugin directories of wordpress), add the following code to your .htacess file:
19. Redirect WordPress Feeds to FeedBurner
The following snippet redirects WordPress’ default RSS feed feedburner’s feed.
1 |
#Redirect wordpress content feeds to feedburner |
2 |
<ifmodule mod_rewrite.c=""> |
4 |
RewriteCond %{HTTP_USER_AGENT} !FeedBurner [NC] |
5 |
RewriteCond %{HTTP_USER_AGENT} !FeedValidator [NC] |
20. Deny Comments from No Referrer Requests
The problem is that bots just post comments about how to increase your private parts all naturally to your blogs without coming from any other site. It’s like they fall from the sky. This neat hack prevents people from posting if they did not come from somewhere else(they can comment just fine if they came from e.g. google).
2 |
RewriteCond %{REQUEST_METHOD} POST |
3 |
RewriteCond %{REQUEST_URI} .wp-comments-post\.php* |
4 |
RewriteCond %{HTTP_REFERER} !.*yourblog.com.* [OR] |
5 |
RewriteCond %{HTTP_USER_AGENT} ^$ |
6 |
RewriteRule (.*) ^http://%{REMOTE_ADDR}/$ [R=301,L] |
Source: How to: Deny comment posting to no referrer requests
21. Remove File Extension From URL
Thanks to Kartlos Tchavelachvili for this one. What the following code does is, it removes the .php extension(you can change it to whatever you like e.g. html) in a url. It makes the URL prettier & SEO friendlier.
1 |
RewriteRule ^(([^/]+/)*[^.]+)$ /$1.php [L] |
22. Remove www from URL
Thanks to Mahalie for the following 2 .htaccess codes.
If you wish to take out the www from your website’s URL and transform it from http://www.example.com into http://example.com, add the following to your .htaccess.
3 |
RewriteCond %{HTTP_HOST} ^www\.domain\.com$ [NC] |
23. Add Trailing Slash to URL
Some search engines remove the trailing slash from urls that look like directories – e.g. Yahoo does it. But – it could result into duplicated content problems when the same page content is accessible under different urls. The following code makes sure there’s a slash at the end of your URL:
1 |
#trailing slash enforcement |
3 |
RewriteCond %{REQUEST_FILENAME} !-f |
4 |
RewriteCond %{REQUEST_URI} !# |
5 |
RewriteCond %{REQUEST_URI} !(.*)/$ |
24. Remove the www. from your website’s URL
Below I’ve provided a simple htaccess snippet to forcefully remove the “www” from your website’s URL.
1 |
# Redirect if www.yourdomain.com to yourdomain.com |
2 |
RewriteCond %{HTTP_HOST} ^www\.example\.com [NC] |
Be aware that mod_rewrite (RewriteRule, RewriteBase, and RewriteCond) code is executed for each and every HTTP request that accesses a file in or below the directory where the code resides, so it’s always good to limit the code to certain circumstances if readily identifiable.
For example, to limit the next 5 RewriteRules to only be applied to .html and .php files, you can use the following code, which tests if the url does not end in .html or .php and if it doesn’t, it will skip the next 5 RewriteRules.
RewriteRule !\.(html|php)$ - [S=5]
RewriteRule ^.*-(vf12|vf13|vf5|vf35|vf1|vf10|vf33|vf8).+$ - [S=1]
Options +FollowSymLinks
RewriteEngine On
RewriteBase /
Options +FollowSymLinks
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_HOST} !^www\.askapache\.com$ [NC]
RewriteRule ^(.*)$ http://www.askapache.com/$1 [R=301,L]
Sometimes your rewrites cause infinite loops, stop it with one of these rewrite code snippets.
RewriteCond %{REQUEST_URI} ^/(stats/|missing\.html|failed_auth\.html|error/).* [NC]
RewriteRule .* - [L]
RewriteCond %{ENV:REDIRECT_STATUS} 200
RewriteRule .* - [L]
This is probably my favorite, and I use it on every site I work on. It allows me to update my javascript and css files in my visitors cache’s simply by naming them differently in the html, on the server they stay the same name. This rewrites all files for /zap/j/anything-anynumber.js to /zap/j/anything.js and /zap/c/anything-anynumber.css to /zap/c/anything.css
RewriteRule ^zap/(j|c)/([a-z]+)-([0-9]+)\.(js|css)$ /zap/$1/$2.$4 [L]
When you use flash on your site and you properly supply a link to download flash that shows up for non-flash aware browsers, it is nice to use a shortcut to keep your code clean and your external links to a minimum. This code allows me to link to site.com/getflash/ for non-flash aware browsers.
RewriteRule ^getflash/?$ http://www.adobe.com/shockwave/download/download.cgi?P1_Prod_Version=ShockwaveFlash [NC,L,R=307]
On many sites, the page will be displayed for both page.html and page.html?anything=anything, which hurts your SEO with duplicate content. An easy way to fix this issue is to redirect external requests containing a query string to the same uri without the query_string.
RewriteCond %{THE_REQUEST} ^GET\ /.*\;.*\ HTTP/
RewriteCond %{QUERY_STRING} !^$
RewriteRule .* http://www.askapache.com%{REQUEST_URI}? [R=301,L]
This .htaccess rewrite example invisibly rewrites requests for all Adobe pdf files to be handled by /cgi-bin/pdf-script.php
RewriteRule ^(.+)\.pdf$ /cgi-bin/pdf-script.php?file=$1.pdf [L,NC,QSA]
For sites using multiviews or with multiple language capabilities, it is nice to be able to send the correct language automatically based on the clients preferred language.
RewriteCond %{HTTP:Accept-Language} ^.*(de|es|fr|it|ja|ru|en).*$ [NC]
RewriteRule ^(.*)$ - [env=prefer-language:%1]
This allows access to all files by php fopen, but denies anyone else.
RewriteEngine On
RewriteBase /
RewriteCond %{THE_REQUEST} ^.+$ [NC]
RewriteRule .* - [F,L]
If you are looking for ways to block or deny specific requests/visitors, then you should definately read Blacklist with mod_rewrite. I give it a 10/10
This can be very handy if you want to serve media files or special downloads but only through a php proxy script.
RewriteEngine On
RewriteBase /
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /([^/]+)/.*\ HTTP [NC]
RewriteRule .* - [F,L]
Options +FollowSymLinks
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_HOST} !^askapache\.com$ [NC]
RewriteRule ^(.*)$ http://askapache.com/$1 [R=301,L]
Uses a RewriteCond Directive to check QUERY_STRING for passkey, if it doesn’t find it it redirects all requests for anything in the /logged-in/ directory to the /login.php script.
RewriteEngine On
RewriteBase /
RewriteCond %{QUERY_STRING} !passkey
RewriteRule ^/logged-in/(.*)$ /login.php [L]
If the QUERY_STRING has any value at all besides blank than the?at the end of /login.php? tells mod_rewrite to remove the QUERY_STRING from login.php and redirect.
RewriteEngine On
RewriteBase /
RewriteCond %{QUERY_STRING} .
RewriteRule ^login.php /login.php? [L]
An error message related to this isRequest exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.or you may seeRequest exceeded the limit,probable configuration error,Use 'LogLevel debug' to get a backtrace, orUse 'LimitInternalRecursion' to increase the limit if necessary
RewriteCond %{ENV:REDIRECT_STATUS} 200
RewriteRule .* - [L]
RewriteRule ^(.*)\.php$ /$1.html [R=301,L]
Redirects all files that end in .html to be served from filename.php so it looks like all your pages are .html but really they are .php
RewriteRule ^(.*)\.html$ $1.php [R=301,L]
Options +FollowSymLinks
RewriteEngine On
RewriteBase /
# If the hour is 16 (4 PM) Then deny all access
RewriteCond %{TIME_HOUR} ^16$
RewriteRule ^.*$ - [F,L]
Converts all underscores “_” in urls to hyphens “-” for SEO benefits… See the full article for more info.
Options +FollowSymLinks
RewriteEngine On
RewriteBase /
RewriteRule !\.(html|php)$ - [S=4]
RewriteRule ^([^_]*)_([^_]*)_([^_]*)_([^_]*)_(.*)$ $1-$2-$3-$4-$5 [E=uscor:Yes]
RewriteRule ^([^_]*)_([^_]*)_([^_]*)_(.*)$ $1-$2-$3-$4 [E=uscor:Yes]
RewriteRule ^([^_]*)_([^_]*)_(.*)$ $1-$2-$3 [E=uscor:Yes]
RewriteRule ^([^_]*)_(.*)$ $1-$2 [E=uscor:Yes]
RewriteCond %{ENV:uscor} ^Yes$
RewriteRule (.*) http://d.com/$1 [R=301,L]
Options +FollowSymLinks
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_HOST} !^www\.[a-z-]+\.[a-z]{2,6} [NC]
RewriteCond %{HTTP_HOST} ([a-z-]+\.[a-z]{2,6})$ [NC]
RewriteRule ^/(.*)$ http://%1/$1 [R=301,L]
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_HOST} \.([a-z-]+\.[a-z]{2,6})$ [NC]
RewriteRule ^/(.*)$ http://%1/$1 [R=301,L]
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_HOST} \.([^\.]+\.[^\.0-9]+)$
RewriteRule ^(.*)$ http://%1/$1 [R=301,L]
Full article:Redirecting Wordpress Feeds to Feedburner
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_URI} ^/feed\.gif$
RewriteRule .* - [L]
RewriteCond %{HTTP_USER_AGENT} !^.*(FeedBurner|FeedValidator) [NC]
RewriteRule ^feed/?.*$ http://feeds.feedburner.com/apache/htaccess [L,R=302]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
Article: Request Methods
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_METHOD} !^(GET|PUT)
RewriteRule .* - [F]
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?askapache.com/.*$ [NC]
RewriteRule \.(gif|jpg|swf|flv|png)$ /feed/ [R=302,L]
RewriteEngine On
SetEnvIfNoCase X-Forwarded-For .+ proxy=yes
SetEnvIfNoCase X-moz prefetch no_access=yes
# block pre-fetch requests with X-moz headers
RewriteCond %{ENV:no_access} yes
RewriteRule .* - [F,L]
This module uses a rule-based rewriting engine (based on a regular-expression parser) to rewrite requested URLs on the fly. It supports an unlimited number of rules and an unlimited number of attached rule conditions for each rule, to provide a really flexible and powerful URL manipulation mechanism. The URL manipulations can depend on various tests, of server variables, environment variables, HTTP headers, or time stamps. Even external database lookups in various formats can be used to achieve highly granular URL matching.
This module operates on the full URLs (including the path-info part) both in per-server context (httpd.conf) and per-directory context (.htaccess) and can generate query-string parts on result. The rewritten result can lead to internal sub-processing, external request redirection or even to an internal proxy throughput.
