Excluding Maintenance Page in specific directory - .htaccess

Currently I use this code in my .htaccess file to trigger my Site's maintenance page.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{DOCUMENT_ROOT}/maintenance.html -f
RewriteCond %{DOCUMENT_ROOT}/maintenance.enable -f
RewriteCond %{SCRIPT_FILENAME} !maintenance.html
RewriteRule ^.*$ /maintenance.html [R=503,L]
ErrorDocument 503 /maintenance.html
Header Set Cache-Control "max-age=0, no-store"
</IfModule>
How Would I make it so I could still access a directory I would be working On and not just my IP address in case my friend wishes to access it.
I have done some searching, but not found anything as of yet
Cheers
Tom

I'd say you can simply implement some exception rules prior to your handling of the maintenance mode:
<IfModule mod_rewrite.c>
RewriteEngine On
# immediately end all rewriting for specific IPV4 addresses
RewriteCond %{REMOTE_ADDR} ^123\.123\.123\.123$ [OR]
RewriteCond %{REMOTE_ADDR} ^321\.321\.321\.321$
RewriteRule ^ - [END]
# for everyone else: check for maintenance mode
RewriteCond %{DOCUMENT_ROOT}/maintenance.html -f
RewriteCond %{DOCUMENT_ROOT}/maintenance.enable -f
RewriteCond %{SCRIPT_FILENAME} !maintenance.html
RewriteRule ^.*$ /maintenance.html [R=503,L]
ErrorDocument 503 /maintenance.html
Header Set Cache-Control "max-age=0, no-store"
</IfModule>
Alternatively you could add the negated conditions as additional conditions to the maintenance mode rewriting logic. But I think the above is easier to read and maintain.

Related

How to block access to my website for everyone except one webite? [duplicate]

In htaccess, how can i block every visitor except those who come from a specific domain
i tried this but without any success :
# serve everyone from specific-domain or specific-user-agent
RewriteCond %{HTTP_REFERER} ^https?://www.specific-domain.com
RewriteRule ^ - [L]
# everybody else receives a forbidden
RewriteRule ^ - [F]
ErrorDocument 403 /forbidden.html
Update : i had certain success with below code BUT it broked my webpage certainly because of the following parameters that overrride or disturbe appearance. if someone has a clue how to order it the good way ?
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_REFERER} ^https://authorizedreferer.com
RewriteRule ^ - [L]
RewriteRule ^ https://unprotected.mydomain.com/ [R,L]
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# serve everyone from specific-domain or specific-user-agent
RewriteCond %{HTTP_REFERER} ^https?://www.specific-domain.com
RewriteRule ^ - [L]
# everybody else receives a forbidden
RewriteRule ^ - [F]
This will indeed allow requests that link from specific-domain.com (ie. this domain is the HTTP Referer) and block everything else. However, it will also block all requests for your static resources, that originate from your site, where your domain is the Referer. So, you need to also allow requests from your domain.
You should also probably allow an empty Referer header. ie. direct requests, when a user types the URL into their browser address bar. Also note that the Referer header can be suppressed in other ways depending on the referrer-policy as set by the originating website. The user themselves can also override the Referer header, so relying on the Referer header is not reliable.
Try the following:
# Serve everyone from specific-domain (and internal requests)
RewriteCond %{HTTP_REFERER} ^https?://www\.your-domain\.com/ [OR]
RewriteCond %{HTTP_REFERER} ^https?://www\.specific-domain\.com/
RewriteRule ^ - [L]
# everybody else receives a forbidden
RewriteRule ^ - [F]
And to allow an empty Referer, include an additional condition:
# Serve everyone from specific-domain (and internal requests and empty referer)
RewriteCond %{HTTP_REFERER} ^$ [OR]
RewriteCond %{HTTP_REFERER} ^https?://www\.your-domain\.com/ [OR]
RewriteCond %{HTTP_REFERER} ^https?://www\.specific-domain\.com/
RewriteRule ^ - [L]
Note that you are currently allowing http or https in the Referer. If this is always https then be specific and remove the ? (optional quantifier). ie. ^https://www\.specific-domain\.com/. And remember to backslash escape the literal dots.

How to restrict a domain on htaccess

The following rule is allowing only www.google.com domain to access the file list.txt
My question, how can I change the rule to restrict www.google.com and allow other domain?
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_HOST} !^(?:www\.)?google\.com$ [NC]
RewriteRule ^list\.txt$ - [NC,F]
</IfModule>
I want the browser response to 404 but not denied response.
Please test and see if this does what you want?
RewriteEngine on
RewriteCond %{HTTP_HOST} ^(?:www\.)?google\.com$ [NC]
RewriteRule ^list\.txt$ - [NC,R=404]
but this might be clearer:
<Files "list.txt">
RewriteEngine on
RewriteCond %{HTTP_HOST} ^(?:www\.)?google\.com$ [NC, R=404]
</Files>
I left out <IfModule mod_rewrite.c> for clarity. If the module is not enabled, you might however prefer the server to not start opposed to just allow access.

AH10039: FastCGI: server and Request exceeded the limit of 10 internal redirects due to probable configuration error. Multi SSL

My shop is supposed to work on monday ... and it is not ready (yet). Stress ...
Recently I moved to SSL and remove the now useless domain mapping plugin.
I am experiencing various problems ( a) download of downloadable files on my WooCommerce shop often fail , b) the theme displayed on my main site homepage is not the one activated ...)
Debug mode is on but no error appears in my pages.
My logs are full of errors :
AH10039: FastCGI: server
and
server and Request exceeded the limit of 10 internal redirects due to probable configuration error.
I suspect my htaccess to be causing at least the 2nd error. ( And I am pretty ignorant in that matter ...) Here it is :
#WFIPBLOCKS - Do not remove this line. Disable Web Caching in Wordfence to remove this data.
Order Deny,Allow
#Do not remove this line. Disable Web Caching in Wordfence to remove this data - WFIPBLOCKS
#SetEnv PHP_VER 5
#SetEnv REGISTER_GLOBALS 0
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
# add a trailing slash to /wp-admin
RewriteRule ^wp-admin$ wp-admin/ [R=301,L]
RewriteCond %{REQUEST_FILENAME} -f
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
RewriteRule ^(wp-(content|admin|includes).*) $1 [L]
RewriteRule ^(.*\.php)$ $1 [L]
RewriteRule . index.php [L]
</IfModule>
# END WordPress
# ultimate hotlink protection
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{REQUEST_FILENAME} -f
RewriteCond %{REQUEST_FILENAME} \.(gif|jpe?g?|png)$ [NC]
RewriteCond %{HTTP_REFERER} !^https?://([^.]+\.)?mainDomain\. [NC]
RewriteCond %{HTTP_REFERER} !^https?://([^.]+\.)?subDomain1\. [NC]
RewriteCond %{HTTP_REFERER} !^https?://([^.]+\.)?subDomain2\. [NC]
RewriteCond %{HTTP_REFERER} !^https?://([^.]+\.)?subDomain3\. [NC]
RewriteCond %{HTTP_REFERER} !^https?://([^.]+\.)?subDomain4\. [NC]
RewriteRule \.(gif|jpe?g?|png)$ - [F,NC,L]
</ifModule>
<FilesMatch "\.(ttf|otf|woff)$">
<IfModule mod_headers.c>
Header set Access-Control-Allow-Origin "*"
</IfModule>
</FilesMatch>
Thanks for any advice !
Nicolas
Solved !
I simply went back to the standard .htaccess given in the network settings

WWW Redirection in an HTACCESS File

I have an htaccess file for a React app at https://searchglutenfree.com/. I want it to automatically rewrite https://www.searchglutenfree.com/ to https://searchglutenfree.com/ while keeping all the params during the redirection.
I found this great default htaccess template on GitHub (https://gist.github.com/iheartmedia-matt/253ccb6183fdeaa5619f615f2cb5a58b), and getting the www to redirect is the last thing I need. Anyone know what I need to add and where in the file to get the WWW rewrite?
<ifModule mod_rewrite.c>
#######################################################################
# GENERAL #
#######################################################################
# Make apache follow sym links to files
Options +FollowSymLinks
# If somebody opens a folder, hide all files from the resulting folder list
IndexIgnore */*
#######################################################################
# REWRITING #
#######################################################################
# Enable rewriting
RewriteEngine On
# If its not HTTPS
RewriteCond %{HTTPS} off
# Comment out the RewriteCond above, and uncomment the RewriteCond below if you're using a load balancer (e.g. CloudFlare) for SSL
# RewriteCond %{HTTP:X-Forwarded-Proto} !https
# Redirect to the same URL with https://, ignoring all further rules if this one is in effect
RewriteRule ^(.*) https://%{HTTP_HOST}/$1 [R,L]
# If we get to here, it means we are on https://
# If the file with the specified name in the browser doesn't exist
RewriteCond %{REQUEST_FILENAME} !-f
# and the directory with the specified name in the browser doesn't exist
RewriteCond %{REQUEST_FILENAME} !-d
# and we are not opening the root already (otherwise we get a redirect loop)
RewriteCond %{REQUEST_FILENAME} !\/$
# Rewrite all requests to the root
RewriteRule ^(.*) /
</ifModule>
<IfModule mod_headers.c>
# Do not cache sw.js, required for offline-first updates.
<FilesMatch "sw\.js$">
Header set Cache-Control "private, no-cache, no-store, proxy-revalidate, no-transform"
Header set Pragma "no-cache"
</FilesMatch>
</IfModule>
If you don’t need this to be dynamic regarding the host name, then I would add a Condition that checks if the host name started with www. after the one that checks for %{HTTPS} off, and add the [OR] flag to the former - and then simply hard-code the host name in the substitution URL of the following Rule.
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\.
RewriteRule ^(.*) https://searchglutenfree.com/$1 [R,L]
If you replace everything between the comments # If its not HTTPS and # If we get to here, it means we are on https:// in your .htaccess you had shown above with that, it should work.
In order to set up the desired redirect, www.example.com to example.com or vice versa, you must have an A record for each name.
To redirect users from www to a plain, non-www domain, insert this configuration:
in your .htaccess:
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ http://%1/$1 [R=301,L]

Need to redirect to HTTPS using my current htaccess

I want to redirect HTTP and www to https://example.com.
I tried using:
# force HTTPS and www.
RewriteEngine On
RewriteCond %{HTTP_HOST} (?!^www\.)^(.+)$ [OR]
RewriteCond %{HTTPS} off
RewriteRule ^ https://www.%1%{REQUEST_URI} [R=301,L]
But the result is only https://www. - the domain disappeared!
My current .htaccess:
<IfModule mod_rewrite.c>
# REWRITE ENGINE CONFIG
#ExpiresActive On
DirectoryIndex under_construction.html index.html index.php
#Header set Cache-Control "max-age=259200, public"
#ExpiresDefault "access plus 3 days"
#Header unset ETag
#FileETag None
# Expires header for static content
#<FilesMatch "\.(ico|jpg|jpeg|png|gif|js|css|swf|jgz|js.jgz)$">
#Header set Cache-Control "max-age=31536000, public"
#ExpiresDefault "access plus 11 months"
#</FilesMatch>
# Auth for non-public projects
#AuthName "ZEN 2.2 Login"
#AuthType Basic
#AuthUserFile /Applications/MAMP/htdocs/username/.htpasswd
#AuthUserFile F:/wamp/www/username/.htpasswd
#AuthGroupFile /dev/null
#require valid-user
# REWRITE CORE RULES RULES -- PLEASE DON'T MODIFY --
# THESE ARE THE MAIN REWRITES THAT MAKE THE ENTIRE WORLD SPIN
AddDefaultCharset UTF-8
# IF NO IMAGE FOUND
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_URI} \.(gif|jpg|jpeg|png)$
RewriteRule .* resources/static/images/no_image.png [L]
RewriteCond $1 !^(index\.php|resources|robots\.txt)
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?page=$1&%{QUERY_STRING} [L,QSA]
RewriteRule ^robots.txt$ resources/static/robots.php [L]
# gZip minified js files
RewriteCond %{HTTP:Accept-Encoding} gzip
RewriteCond %{REQUEST_FILENAME}.jgz -f
RewriteRule (.*)\.js$ $1\.js.jgz [L]
AddType "text/javascript" .js.jgz
AddEncoding gzip .jgz
# gZip minified css files
RewriteCond %{HTTP:Accept-Encoding} gzip
RewriteCond %{REQUEST_FILENAME}.jgz -f
RewriteRule (.*)\.css$ $1\.css.jgz [L]
AddType "text/css" .css.jgz
AddEncoding gzip .jgz
</IfModule>
Need some help adding the redirection to HTTPS and non-WWW to the current .htaccess file.
The problem when using code from here -> https://gist.github.com/vielhuber/f2c6bdd1ed9024023fe4
Is that the redirection is broken, and the result is https://www. only, no domain name is showing.
Try:
# force HTTPS and www.
RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [OR]
RewriteCond %{HTTPS} !on
RewriteRule ^(.*)$ https://%1%{REQUEST_URI} [R=301,QSA,L]
Some webservers don't create the HTTPS header when http protocol is used. So if HTTPS is not on (is off or null) this condition is true.
# force HTTPS and www.
RewriteEngine On
RewriteCond %{HTTP_HOST} (?!^www\.)^(.+)$ [OR]
RewriteCond %{HTTPS} off
RewriteRule ^ https://www.%1%{REQUEST_URI} [R=301,L]
The problem with this code is, as the preceding comment suggests, it tries to redirect to www, not the domain apex. But it is also fundamentally flawed since the first condition is not always met (when HTTPS is off and www is requested), so the %1 backreference is not always set (so the domain name is omitted from the redirect - as you have found).
If you want a generalised (ie. without explicitly stating the hostname) solution then you would need to do something like the following instead:
RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\. [OR]
RewriteCond %{HTTPS} off
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)
RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L]
The above rule block states... for all requests that are either for the www subdomain OR are for HTTP then redirect to HTTPS, less the www subdomain (if any) at the same URL-path.
The purpose of the 3rd condition - which must always match - is to simply capture the hostname less the www subdomain (if any). This is then referenced using the %1 backreference in the RewriteRule substitution.
NB: Test with a 302 (temporary) redirect first to avoid caching issues.
You will need to clear your browser cache before testing.
UPDATE: it is redirecting to domainname.com:443
That shouldn't be happening with the above directives, unless perhaps the port is explicitly included in the request? (But is that a redirect for http or https?)
You can try changing the 3rd condition to read:
RewriteCond %{HTTP_HOST} ^(?:www\.)?([^:]+)
Or hardcode the canonical hostname, which is arguably preferable and more reliable (without knowing your system). For example:
RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\. [OR]
RewriteCond %{HTTPS} off
RewriteRule ^ https://example.com%{REQUEST_URI} [R=301,L]
With this hardcoded solution, it cannot possibly redirect to anything other than the canonical URL - regardless of the request or system configuration.
EDIT#1: if I remove the htaccess file completely, the website still redirect to :443 if access from https
To help with debugging, try the following in your .htaccess file and then access https://your-domain.com/. What happens?
RewriteEngine On
RewriteCond %{HTTPS} on
RewriteRule ^ - [F]
If you see a 403 Forbidden response then your web application would seem to be triggering this redirect. If not and you are still redirected then something in the main server config / virtual host would seem to be triggering the redirect.
EDIT#2: Yes, the response when i browse the https is 403 Forbidden.
That would seem to suggest that your web application is triggering this redirect.
And this would seem to be further backed up by the fact that you only seem to get this malformed redirect when requesting a valid URL, ie. one which only the app knows about. For example, https://example.com/contact (a valid page) is redirecting to http://example.com:443/contact (ERROR), but https://example.com/does-not-exist does not redirect (you get an application error / 404).

Resources