.htaccess file tutorials and htaccess articles

Search AskApache

.htaccess (Hypertext Access) is the default name of Apache's directory-level configuration file. It provides the ability to customize configuration directives defined in the main configuration file. The configuration directives need to be in .htaccess context and the user needs appropriate permissions. ".htaccess iis" for windows, ".htaccess windows" and also look at sample .htaccess files to really get good at creating htaccess files.

The directive quick reference (below) shows the usage, default, status, and context of each Apache configuration directive. For more information about each of these, see the Directive Dictionary.

More .htaccess: Htpasswd, Htaccess Redirection, Htaccess Generators, Htaccess Redirect, Htaccess File FTP No Password, 302 Htaccess, Htaccess Instructions

Mod_Rewrite Variables Cheatsheet

We’ve figured out what mod_rewrite variables look like, a cheatsheet of the actual value.

Related · cheatsheet · RDF · RSS | 1:05 am

Optimize a Website for Speed, Security, and Easy Management

Learn how to setup, configure, secure, optimize, and create a low-maintenance website the AskApache way. I’m piecing together all the hacks, tricks, methods, and ideas discussed throughout this blog and all across Netdom and glueing them all together to show you how to have the most optimized, crazy fastest, and best website setup I can think of.

Related · security · RDF · RSS | 8:45 pm

Crazy Advanced Mod_Rewrite Tutorial

Note: Extremely ILL Content
Find the key to unlocking mod_rewrite and you WILL be sick.. sick with a diamond disease on your wrist!

Related · mod_rewrite · RDF · RSS | 12:54 pm

Pimp out your FeedBurner Count

I’ve had a lot of people ask about the FeedBurner FeedCount image on AskApache. Specifically how to set it up with custom messages and different colors each page view… It is pretty sweet..

Related · custom · RDF · RSS | 4:50 am

Notes from Apache HTTPD Source Code

thought I’d take a break from coding and post about how open-source is such a great tool for finding the best answers to the toughest questions,

/** is the status code informational */
#define ap_is_HTTP_INFO(x)         (((x) >= 100)&&((x) < 200))
/** is the status code OK ?*/

#define ap_is_HTTP_SUCCESS(x)      (((x) >= 200)&&((x) < 300))
/** is the status code a redirect */
#define ap_is_HTTP_REDIRECT(x)     (((x) >= 300)&&((x) < 400))

/** is the status code a error (client or server) */
#define ap_is_HTTP_ERROR(x)        (((x) >= 400)&&((x) < 600))
/** is the status code a client error  */

#define ap_is_HTTP_CLIENT_ERROR(x) (((x) >= 400)&&((x) < 500))
/** is the status code a server error  */
#define ap_is_HTTP_SERVER_ERROR(x) (((x) >= 500)&&((x) < 600))

/** is the status code a (potentially) valid response code?  */
#define ap_is_HTTP_VALID_RESPONSE(x) (((x) >= 100)&&((x) < 600))

Related · httpd.c · RDF · RSS | 3:08 am

Htaccess SEO Trends by Google

htaccess vs. httpd.conf

Related · google trends · RDF · RSS | 10:10 am

.htaccess files - Ultimate .htaccess file Tutorial

Apache .htaccess file, tips, tricks, and sample code including mod_rewrite, SSL, headers, and cache.. 15 Chapters of .htaccess examples for Password Protection with Authentication, rewrite URLs with mod_rewrite module, configure PHP in htaccess, use SSL Encryption, protect files, block spam and hotlinking. Learn how to use this per-directory Apache config file like a Server Administrator.

Related · htaccess · RDF · RSS | 9:00 am

.htaccess Plugin Blocks Spam, Hackers, and Password Protects Blog

I finally got around to updating this plugin, its now half-way decent code-wise. I’ve added a lot of new security modules and improved the old ones. The original plugin page and description can be found here. 4.7 is coming…

Related · htaccess · RDF · RSS | 3:18 pm

Securing php.ini and php.cgi with .htaccess

If you have a php.cgi or php.ini file in your /cgi-bin/ directory or other pub directory, try requesting them from your web browser. If your php.ini shows up or worse you are able to execute your php cgi, you’ll need to secure it ASAP. This shows several ways to secure these files, and other interpreters like perl, fastCGI, bash, csh, etc.

Related · suEXEC · RDF · RSS | 11:01 pm

Smart HTTP and HTTPS RewriteRule Redirects

This is freaking sweet if you use SSL I promise you! Basically instead of having to check for HTTPS using a RewriteCond %{HTTPS} =on for every redirect that can be either HTTP or HTTPS, I set an environment variable once with the value “http” or “https” if HTTP or HTTPS is being used for that request, and use that env variable in the RewriteRule.

Related · rewrite · RDF · RSS | 12:34 pm

Mod_Security .htaccess tricks

Mod_Security rivals Mod_Rewrite in the amount of features it provides. I decided to go ahead and post what I learned about it today, even though its tough to give away such awesome htaccess and apache tricks.. Learn how to control spam once and for all, conditionally log/deny/allow/redirect requests based on IP, username, etc.. Mod_Security is so fine!

Related · SecAudit · RDF · RSS | 2:17 am

Blocking Bad Bots and Scrapers with .htaccess

Want to block a bad robot or web scraper using .htaccess files? Here are 2 methods that illustrate blocking 436 various user-agents.

Related · setenvif · RDF · RSS | 11:04 am

Apache SSL in htaccess examples

SSLOptions +StrictRequire
SSLRequireSSL
SSLRequire %{HTTP_HOST} eq "google.com"
ErrorDocument 403 https://google.com

Some of the Ins and Outs of using SSL Connections with Apache.

Related · Apache · RDF · RSS | 9:31 pm

Fresh .htaccess Examples: Cookies, Variables, Custom Headers

Fresh .htaccess code for you! Check out the Cookie Manipulation and environment variable usage with mod_rewrite! I also included a couple Mod_Security .htaccess examples. Enjoy!

Related · setenvif · RDF · RSS | 12:46 pm

PHP Sessions/Cookies On The Fly

This article shows how to save and modify php session data, cookies, do anything really… without using ajax or iframes or forcing the user make a request.

Related · javascript · RDF · RSS | 6:08 am

Speed Tips: Add Cache-Control Headers

Using Cache-Control headers you can specify which types of proxies can cache certain content, and how long files should be cached.

Related · cache · RDF · RSS | 11:53 pm

.htaccess mod_rewrite rewrite examples

A hit-list of some of my favorite mod_rewrite code snippets for .htaccess files

Related · 301 · RDF · RSS | 3:38 pm

Hacking WP Super Cache for Speed

A plugin built to generate static files from php+mysql for Apache to serve the way its supposed to be.. My dream. Conclusion: Needs some improvement, pretty sweet though.

Related · htaccess · RDF · RSS | 9:41 am

Log all .htaccess/.htpasswd logins

Learn how to log and debug usernames and passwords used to login to a htaccess basic authorization protected website using php. This article is BOSS and will show you how to fully take control of this aspect of security using php and .htaccess, I don’t believe you will find instructions to do this anywhere else on the net.

Related · password · RDF · RSS | 9:20 pm

Skeleton .htaccess file for Powweb Hosting

If you have a Powweb Webhosting account, you will appreciate this simple skeleton .htaccess file for use on their systems.

Related · hosting · RDF · RSS | 5:05 am

Redirect Wordpress Feeds to Feedburner

FeedBurner is so RAD! I love it. Here’s an alternative method to redirect scrapers and feed requests to your feedburner url, in my case, I use Branding by feedburner, which is so hot, taking advantage of CNAMEs in your DNS record.

Related · rewritecond · RDF · RSS | 8:05 pm

SetEnvIf and SetEnvIfNoCase Examples

SetEnvIf and SetEnvIfNoCase directives conditionally set environment variables accessible by scripts and apache based on HTTP Headers, Variables, and Request information.

Related · SetEnvIfNoCase · RDF · RSS | 1:36 pm

HTTP Status Codes and ErrorDocuments

There are a total of 57 HTTP Status Codes recognized by the Apache Web Server. Wouldn’t you like to see what all those headers and their output, ErrorDocuments look like?

Related · mod-rewrite · RDF · RSS | 3:56 pm

mod_rewrite Fix for Caching Updated Files

Web Developers sometimes use file.ext?v=004 as a version control system to force visitors to use updated files. This is terrible. Instead link to apache-003.css and set it to be cached forever. When you change the file you just change the links to apache-004.css. That eliminates millions of bandwidth and resource robbing If-Modified-Since requests. You only need Apache with mod_rewrite, and 1-10 minutes!

Related · cache · RDF · RSS | 9:20 am

301 Redirect Cheatsheet

Ultimate Redirect Cheatsheet for multiple programming languages. Redirecting Users with Javascript redirect, meta refresh redirect, and php redirect, also htaccess methods, python, coldfusion, asp, perl, etc.

Related · href · RDF · RSS | 9:48 pm

A better way to use PDF files online

.htaccess and php example serves .pdf files to give visitors the choice to open in an external program or save to disk without having to open it in the browser

PDF Before and after Fix - Firefox

Related · htaccess · RDF · RSS | 2:54 am

AcceptPathInfo On|Off|Default: Resources accept trailing pathname information
Action action-type cgi-script [virtual]: Activates a CGI script for a particular handler or content-type
addalt: Alternate text to display for a file, instead of an icon selected by filename
AddAltByEncoding string MIME-encoding [ MIME-encoding ]: Alternate text to display for a file instead of an icon selected by MIME-encoding
addaltbytype: Alternate text to display for a file, instead of an icon selected by MIME content-type
AddCharset charset extension [ extension ]: Maps the given filename extensions to the specified content charset
adddefaultcharset: Default charset parameter to be added when a response content-type is text/plain or text/html
AddDescription string file [ file ]: Description to display for a file
addencoding: Maps the given filename extensions to the specified encoding type
AddHandler handler-name extension [ extension ]: Maps the filename extensions to the specified handler
addicon: Icon to display for a file selected by name
AddIconByEncoding icon MIME-encoding [ MIME-encoding ]: Icon to display next to files selected by MIME content-encoding
addiconbytype: Icon to display next to files selected by MIME content-type
AddInputFilter filter [; filter ...] extension [ extension ]: Maps filename extensions to the filters that will process client requests
addlanguage: Maps the given filename extension to the specified content language
addoutputfilter: Maps filename extensions to the filters that will process responses from the server
AddOutputFilterByType filter [; filter ...] MIME-type [ MIME-type ]: assigns an output filter to a particular MIME-type
addtype: Maps the given filename extensions onto the specified content type
Allow from all| host |env= env-variable [ host |env= env-variable ]: Controls which hosts can access an area of the server
Anonymous user [ user ]: Specifies userIDs that are allowed access without password verification
Anonymous_LogEmail On|Off: Sets whether the password entered will be logged in the error log
Anonymous_MustGiveEmail On|Off: Specifies whether blank passwords are allowed
Anonymous_NoUserID On|Off: class="odd"
Anonymous_VerifyEmail On|Off: Sets whether to check the password field for a correctly formatted email address
AuthBasicAuthoritative On|Off: Sets whether authorization and authentication are passed to lower level modules
AuthBasicProvider provider-name [ provider-name ]: class="odd"
AuthDBMGroupFile file-path: Sets the name of the database file containing the list of user groups for authorization
AuthDBMType default|SDBM|GDBM|NDBM|DB: Sets the type of database file that is used to store passwords
AuthDBMUserFile file-path: Sets the name of a database file containing the list of users and passwords for authentication
AuthDefaultAuthoritative On|Off: Sets whether authentication is passed to lower level modules
AuthDigestAlgorithm MD5|MD5-sess: Selects the algorithm used to calculate the challenge and response hashes in digest authentication
authdigestdomain: URIs that are in the same protection space for digest authentication
AuthDigestNonceFormat format: class="odd"
AuthDigestNonceLifetime seconds: How long the server nonce is valid
AuthDigestProvider provider-name [ provider-name ]: class="odd"
AuthDigestQop none|auth|auth-int [auth|auth-int]: Determines the quality-of-protection to use in digest authentication
AuthGroupFile file-path: Sets the name of a text file containing the list of user groups for authorization
AuthLDAPBindDN distinguished-name: class="odd"
AuthLDAPBindPassword password: Password used in conjuction with the bind DN
AuthLDAPCompareDNOnServer on|off: Use the LDAP server to compare the DNs
AuthLDAPDereferenceAliases never|searching|finding|always: class="odd"
AuthLDAPGroupAttribute attribute: LDAP attributes used to check for group membership
AuthLDAPGroupAttributeIsDN on|off: Use the DN of the client username when checking for group membership
AuthLDAPRemoteUserAttribute uid: Use the value of the attribute returned during the user query to set the REMOTE_USER environment variable
AuthLDAPRemoteUserIsDN on|off: Use the DN of the client username to set the REMOTE_USER environment variable
AuthLDAPUrl url [NONE|SSL|TLS|STARTTLS]: URL specifying the LDAP search parameters
authname: Authorization realm for use in HTTP authentication
AuthType Basic|Digest: class="odd"
AuthUserFile file-path: Sets the name of a text file containing the list of users and passwords for authentication
AuthzDBMType default|SDBM|GDBM|NDBM|DB: Sets the type of database file that is used to store list of user groups
AuthzDefaultAuthoritative On|Off: Sets whether authorization is passed to lower level modules
AuthMergeRules on | off: Set to 'on' to allow the parent's <Directory> or <Location> authz rules to be merged into the current <Directory> or <Location>. Set to 'off' to disable merging. If set to 'off', only the authz rules defined in the current <Directory> or <Location> block will apply.
browsermatch: Sets environment variables conditional on HTTP User-Agent
browsermatchnocase: Sets environment variables conditional on User-Agent without respect to case
CGIMapExtension cgi-path .extension: Technique for locating the interpreter for CGI scripts
CharsetDefault charset: class="odd"
CharsetOptions option [ option ]: Configures charset translation behavior
CharsetSourceEnc charset: class="odd"
CheckCaseOnly on|off: Limits the action of the speling module to case corrections
CheckSpelling on|off: Enables the spelling module
ContentDigest On|Off: Enables the generation of Content-MD5 HTTP Response headers
CookieDomain domain: The domain to which the tracking cookie applies
CookieExpires expiry-period: class="odd"
CookieName token: class="odd"
CookieStyle Netscape|Cookie|Cookie2|RFC2109|RFC2965: Format of the cookie header field
CookieTracking on|off: class="odd"
defaulticon: Icon to display for files when no specific icon is configured
DefaultLanguage MIME-lang: Sets all files in the given scope to the specified language
defaulttype: MIME content-type that will be sent if the server cannot determine a type in any other way
Deny from all| host |env= env-variable [ host |env= env-variable ]: Controls which hosts are denied access to the server
DirectoryIndex local-url [ local-url ]: List of resources to look for when the client requests a directory
DirectorySlash On|Off: Toggle trailing slash redirects on or off
EnableMMAP On|Off: Use memory-mapping to read files during delivery
EnableSendfile On|Off: class="odd"
ErrorDocument error-code document: What the server will return to the client in case of an error
Example: Demonstration directive to illustrate the Apache module API
ExpiresActive On|Off: class="odd"
ExpiresByType: Value of the Expires header configured by MIME type
ExpiresDefault: class="odd"
fileetag: File attributes used to create the ETag HTTP response header
<Files filename > ... </Files>: Contains directives that apply to matched filenames
> ... </FilesMatch>: Contains directives that apply to regular-expression matched filenames
FilterChain [+=-@!] filter-name ...: Configure the filter chain
FilterDeclare filter-name [type]: class="odd"
FilterProtocol filter-name [ provider-name ] proto-flags: Deal with correct HTTP protocol handling
FilterProvider filter-name provider-name [req|resp|env]= dispatch match: class="odd"
ForceLanguagePriority None|Prefer|Fallback [Prefer|Fallback]: Action to take if a single acceptable document is not found
ForceType MIME-type |None: Forces all matching files to be served with the specified MIME content-type
header: Configure HTTP response headers
headername: Name of the file that will be inserted at the top of the index listing
> ... </IfDefine>: Encloses directives that will be processed only if a test is true at startup
> ... </IfModule>: Encloses directives that are processed conditional on the presence or absence of a specific module
> ... </IfVersion>: contains version dependent configuration
ImapBase map|referer| URL: [ http://servername/ | hsvd | B ]
imapdefault: Default action when an imagemap is called with coordinates that are not explicitly mapped
ImapMenu none|formatted|semiformatted|unformatted: Action if no coordinates are given when calling an imagemap
IndexIgnore file [ file ]: Adds to the list of files to hide when listing a directory
indexoptions: Various configuration settings for directory indexing
IndexOrderDefault Ascending|Descending Name|Date|Size|Description: Sets the default ordering of the directory index
IndexStyleSheet url-path: class="odd"
ISAPIAppendLogToErrors on|off: Record HSE_APPEND_LOG_PARAMETER requests from ISAPI extensions to the error log
ISAPIAppendLogToQuery on|off: Record HSE_APPEND_LOG_PARAMETER requests from ISAPI extensions to the query field
ISAPIFakeAsync on|off: class="odd"
ISAPILogNotSupported on|off: Log unsupported feature requests from ISAPI extensions
isapireadaheadbuffer: Size of the Read Ahead Buffer sent to ISAPI extensions
languagepriority: The precendence of language variants for cases where the client does not express a preference
LDAPTrustedClientCert type directory-path/filename/nickname [password]: Sets the file containing or nickname referring to a per connection client certificate. Not all LDAP toolkits support per connection client certificates.
] ... > ... </Limit>: Restrict enclosed access controls to only certain HTTP methods
] ... > ... </LimitExcept>: Restrict access controls to all HTTP methods except the named ones
limitrequestbody: Restricts the total size of the HTTP request body sent from the client
LimitXMLRequestBody bytes: class="odd"
MetaDir directory: Name of the directory to find CERN-style meta information files
MetaFiles on|off: class="odd"
MetaSuffix suffix: File name suffix for the file containg CERN-style meta information
MultiviewsMatch Any|NegotiatedOnly|Filters|Handlers [Handlers|Filters]: The types of files that will be included when searching for a matching file with MultiViews
options: Configures what features are available in a particular directory
order: Controls the default access state and the order in which Allow and Deny are evaluated.
passenv: Passes environment variables from the shell
readmename: Name of the file that will be inserted at the end of the index listing
Redirect [ status ] URL-path URL: Sends an external redirect asking the client to fetch a different URL
redirectmatch: Sends an external redirect based on a regular expression match of the current URL
RedirectPermanent URL-path URL: Sends an external permanent redirect asking the client to fetch a different URL
redirecttemp: Sends an external temporary redirect asking the client to fetch a different URL
Reject entity-name [ entity-name ]: Rejects authenticated users or host based requests from accessing a resource
removecharset: Removes any character set associations for a set of file extensions
removeencoding: Removes any content encoding associations for a set of file extensions
removehandler: Removes any handler associations for a set of file extensions
removeinputfilter: Removes any input filter associations for a set of file extensions
removelanguage: Removes any language associations for a set of file extensions
removeoutputfilter: Removes any output filter associations for a set of file extensions
removetype: Removes any content type associations for a set of file extensions
RequestHeader set|append|merge|add|unset|edit header [ value ] [ replacement ] [early|env=[!] variable ]: Configure HTTP request headers
require: Selects which authenticated users can access a resource
RewriteBase URL-path: Sets the base URL for per-directory rewrites
RewriteCond TestString CondPattern: class="odd"
RewriteEngine on|off: Enables or disables runtime rewriting engine
RewriteOptions Options: class="odd"
RewriteRule Pattern Substitution [flags]: Defines rules for the rewriting engine
|max]: Limits the CPU consumption of processes launched by Apache children
RLimitMEM bytes |max [ bytes |max]: Limits the memory consumption of processes launched by Apache children
|max]: Limits the number of processes that can be launched by processes launched by Apache children
Satisfy Any|All: Interaction between host-level access control and user authentication
<SatisfyAll> ... </SatisfyAll>: Enclose a group of authorization directives that must all be satisfied in order to grant access to a resource. This block allows for 'AND' logic to be applied to various authorization providers.
<SatisfyOne> ... </SatisfyOne>: Enclose a group of authorization directives that must satisfy at least one in order to grant access to a resource. This block allows for 'OR' logic to be applied to various authorization providers.
ScriptInterpreterSource Registry|Registry-Strict|Script: Technique for locating the interpreter for CGI scripts
ServerSignature On|Off|EMail: Configures the footer on server-generated documents
SetEnv env-variable value: Sets environment variables
setenvif: Sets environment variables based on attributes of the request
setenvifnocase: Sets environment variables based on attributes of the request without respect to case
None: Forces all matching files to be processed by a handler
SetInputFilter filter [; filter ...]: Sets the filters that will process client requests and POST input
setoutputfilter: Sets the filters that will process responses from the server
SSIEnableAccess on|off: Enable the -A flag during conditional flow control processing.
ssierrormsg: Error message displayed when there is an SSI error
ssitimeformat: Configures the format in which date strings are displayed
SSIUndefinedEcho string: class="odd"
sslciphersuite: Cipher Suite available for negotiation in SSL handshake
SSLOptions [+|-]option: Configure various SSL engine run-time options
sslproxyciphersuite: Cipher Suite available for negotiation in SSL proxy handshake
SSLProxyVerify level: Type of remote server Certificate verification
sslproxyverifydepth: Maximum depth of CA Certificates in Remote Server Certificate verification
sslrequire: Allow access only when an arbitrarily complex boolean expression is true
SSLRequireSSL: Deny access when SSL is not used for the HTTP request
SSLUserName varname: class="odd"
SSLVerifyClient level: Type of Client Certificate verification
sslverifydepth: Maximum depth of CA Certificates in Client Certificate verification
unsetenv: Removes variables from the environment
XBitHack on|off|full: Parse SSI directives in files with the execute bit set

Except where otherwise noted, content on this site is licensed under a Creative Commons Attribution 3.0 License, which lets you use/modify/re-post this content provided you follow the attribution guidelines in the license.

Apache Software WebRing
Prev | Ring Hub | Join | Next

It's very simple -
you read the protocol
and write the code.
~Bill Joy

Contact Webmaster | Glossary | Indianapolis, Indiana, U.S.A

.htaccess file tutorials and htaccess articles

Search AskApache

Mod_Rewrite Variables Cheatsheet

Optimize a Website for Speed, Security, and Easy Management

Crazy Advanced Mod_Rewrite Tutorial

Pimp out your FeedBurner Count

Notes from Apache HTTPD Source Code

Htaccess SEO Trends by Google

.htaccess files - Ultimate .htaccess file Tutorial

.htaccess Plugin Blocks Spam, Hackers, and Password Protects Blog

Securing php.ini and php.cgi with .htaccess

Smart HTTP and HTTPS RewriteRule Redirects

Mod_Security .htaccess tricks

Blocking Bad Bots and Scrapers with .htaccess

Apache SSL in htaccess examples

Fresh .htaccess Examples: Cookies, Variables, Custom Headers

PHP Sessions/Cookies On The Fly

Speed Tips: Add Cache-Control Headers

.htaccess mod_rewrite rewrite examples

Hacking WP Super Cache for Speed

Log all .htaccess/.htpasswd logins

Skeleton .htaccess file for Powweb Hosting

Redirect Wordpress Feeds to Feedburner

SetEnvIf and SetEnvIfNoCase Examples

HTTP Status Codes and ErrorDocuments

mod_rewrite Fix for Caching Updated Files

301 Redirect Cheatsheet

A better way to use PDF files online

Apache Directives and Modules on DreamHost

Apache HTTPD Google CSE

WordPress RewriteRules Viewer

Speed Tips: Use Multiple SubDomains