How do I deny access to invalid web subdomains with .htaccess? - .htaccess

The following .htaccess file does not work:
SSLrequireSSL
RewriteEngine on
RewriteCond %{HTTP_HOST} !^secure\.neuralfutures\.com [NC]
RewriteRule (.*) - [F]
I'm trying to prevent access to anything but "https://secure.neuralfutures.com/docs/", i.e. "https://www.neuralfutures.com/docs/" will fail.
I also seem to be running into caching issues: if I upload the new .htaccess with CuteFTP, then do a file refresh in FireFox, it doesn't seem to have any effect on the output at all. I can tell this because if I comment out SSLrequireSSL, it still disallows a http:// request.

why dont you try this
SSLrequireSSL
RewriteEngine on
RewriteCond %{HTTP_HOST} !^secure\.neuralfutures\.com [NC]
RewriteRule (.*) https://secure.neuralfutures.com%{REQUEST_URI} [R=301,NC,L]
Abt caching - May be your web hosting provider has some caching in place, but not very sure abt this.

Related

Using .htaccess to redirect mobile and desktop from http to https versions

We have installed a SSL for our site and I have created an .htaccess with the following code:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
RewriteCond %{ENV:HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
# mobile redirect
RewriteCond %{HTTP_HOST} ^www\mobile.example\.com [NC]
RewriteCond %
{HTTP_USER_AGENT}"android|blackberry|iphone|ipod|iemobile|opera mobile|palmos|webos|googlebot-mobile" [NC]
RewriteRule ^(.*)$ https://mobile.example.com/$1 [L,R=302]
</IfModule>
This code works great coming from the desktop, but the mobile part is not working. What am I missing?
...but the mobile part is not working.
You've not stated explicitly what the "mobile" part is expected to do. However, the "mobile part" in your code would seem to just be a www to non-www redirect. The HTTP to HTTPS redirect is separate to this and does not differentiate between mobile and desktop (and neither would it necessarily need to).
However, there are several issues with the directives in the "mobile part" that will prevent it from "working" (and also with the HTTP to HTTPS redirect).
The directives are in the wrong order. Both of the external redirects (HTTP to HTTPS and "mobile" www to non-www) should be before the internal rewrite (the first couple of rules)
I assume ENV:HTTPS (that references an environment variable called HTTPS) is as per instruction from your webhost. This is non-standard, although not uncommon with some shared hosts.
RewriteCond %{HTTP_HOST} ^www\mobile.example\.com [NC] - You are missing a dot after the www subdomain (assuming that is what you trying to match). So, this will never match. You are also missing a slash before the dot in the middle of the regex (to match a literal dot, not any character). The CondPattern should presumably read ^www\.mobile\.example\.com in order to match the www subdomain.
RewriteCond % {HTTP_USER_AGENT}"android|blackberry|iphone|ipod|iemobile|opera mobile|palmos|webos|googlebot-mobile" [NC] - You are missing a space after the first argument %{HTTP_USER_AGENT}<here>. Although you also appear to have an erroneous space after the %. Either way, this will fail to match. However, I would also question why you specifically need to match the mobile user-agent here? I would think you need to redirect www to non-www regardless of user-agent? Why would you permit a desktop user-agent access to www.mobile.example.com? So, this condition can perhaps be removed entirely.
Not a bug, but you probably don't need the <IfModule> wrapper, unless these directives are optional and you are porting the same code to multiple servers where mod_rewrite might not be available. See my answer to a related question on the Webmasters stack: https://webmasters.stackexchange.com/questions/112600/is-checking-for-mod-write-really-necessary
Again, not a bug, but the RewriteBase / directive in this block of code is entirely redundant.
Taking the above points into consideration, it should be written more like this:
RewriteEngine On
# HTTP to HTTPS redirect - all hosts
RewriteCond %{ENV:HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
# mobile redirect
RewriteCond %{HTTP_HOST} ^www\.mobile\.example\.com [NC]
RewriteCond %{HTTP_USER_AGENT} "android|blackberry|iphone|ipod|iemobile|opera mobile|palmos|webos|googlebot-mobile" [NC]
RewriteRule (.*) https://mobile.example.com/$1 [R=302,L]
# Front-controller
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
Like I said in the notes above, I question the use of the RewriteCond %{HTTP_USER_AGENT} directive to detect mobile-only user-agents. If all users should be redirected www to non-www (as it looks like they should) then simply remove this condition. This should also presumably be a 301 (permanent) redirect once you have confirmed that it works as intended.
Taking this a step further, don't you also want to canonicalise desktop clients as well? ie. Redirect www to non-www on all hosts?
This code works great coming from the desktop
Although there's no reason why this didn't work "great" from mobile either if you were requesting the conanical host, ie. https://mobile.example.com/.
UPDATE: What I need for the .htaccess to do is redirect all traffic - desktop and mobile etc - to the new https instead of HTTP.
By the sounds of it you only need a "simple" HTTP to HTTPS redirect. The "front-controller pattern" that you have seemingly copied from the webhost's article may be in error?
Try the following instead in the root .htaccess file.
RewriteEngine On
# Redirect all requests from HTTP to HTTPS on the same host
RewriteCond %{ENV:HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
You should remove all other directives and make sure there are no other .htaccess files in subdirectories.
The REQUEST_URI server variable contains the requested URL-path. This will be required, instead of using a backreference as you had initially, if your mobile subdomain points to a subdirectory off the main domain's document root (which you hint at in comments, but not stated in the question).
You must clear the browser cache before testing and test first with 302 (temporary) redirects before changing to a 301 (permanent) redirect only once you have confirmed the redirect works as intended.

Forwarding a subdomain to another subdomain [duplicate]

Does anyone know a way to do a permanent redirect from a.example.com to b.example.com? I have other subdomains that need to remain as they are though. so:
first.example.com -> second.example.com
third.example.com is fine
fourth.example.com is fine
I want to do this in the <VirtualHost> block rather than an .htaccess to avoid having to redeploy again.
Any thoughts would be appreciated, thanks
Add the following RewriteRule to your VirtualHost
RewriteEngine On
RewriteCond %{HTTP_HOST} ^first.example.com$
RewriteRule ^ http://second.example.com [R=301,L]
If you wanted to redirect first.example.com/some/url to second.example.com/some/url:
RewriteEngine On
RewriteCond %{HTTP_HOST} ^first.example.com$
RewriteRule /(.*) http://second.example.com/$1 [R=301,L]
Recommend you use [R=302] whilst testing the rules to avoid problems with 301s getting cached by your browser.

htaccess subdomain to subdomain/subfolder

This is driving me crazy. Basically, I want to redirect the following:
http://subdomain.mysite.com/ (with or without trailing slash)
to (exactly)
http://subdomain.mysite.com/subdomain/
This currently gives me an endless loop
RewriteCond %{HTTP_HOST} ^subdomain\.mysite\.com$ [NC]
RewriteRule ^(.*)$ subdomain/$1 [R=301]
But whatever rule I try, it always ends up in a loop because the target still matches the redirect criteria. Some help would be appreciated.
You need to add a condition to break the endless loop.
Note that this loop will only arise if you really want to keep the host name unaltered, so rewrite inside the same host, but still do an external redirect as you suggest. This is somewhat surprising, but certainly possible:
RewriteEngine on
RewriteCond %{HTTP_HOST} ^subdomain\.example\.com$ [NC]
RewriteCond %{REQUEST_URI} ^/subdomain/ [NC]
RewriteRule ^(.*)$ subdomain/$1 [L,R=301,QSA]
This implements an external redirection, the additional condition is required to prevent the redirection loop:
https://subdomain.example.com/foo > https://subdomain.example.com/subdomain/foo
The same loop does not arise if you rewrite to another host name:
RewriteEngine on
RewriteCond %{HTTP_HOST} ^subdomain\.example\.com$ [NC]
RewriteRule ^(.*)$ https://www.example.com/subdomain/$1 [L,R=301,QSA]
This implements an external redirection, no additional condition is required, since the existing one already prevents the redirection loop:
https://subdomain.example.com/foo > https://www.example.com/subdomain/foo
A more often seen approach is to only rewrite internally, so without actually changing the URL visible in the browser:
RewriteEngine on
RewriteCond %{HTTP_HOST} ^subdomain\.example\.com$ [NC]
RewriteCond %{REQUEST_URI} ^/subdomain/ [NC]
RewriteRule ^(.*)$ subdomain/$1 [L,QSA]
This implements an internal redirection, so the visible URL in the client stays unchanged:
https://subdomain.example.com/foo > /subdomain/foo
Doesn't seem to work at all. I know its a bit strange but its for legacy reasons. The whole server mysite.com is old and just for archive purpose - and requires authorization to access. Except the /subdomain folder which still needs to be accessible.
mysite.com and subdomain.mysite.com point to the same home directory (historical reasons..)
With this setup http://subdomain.mysite.com/subdomain/ works perfectly fine ... but someone here really wants http://subdomain.mysite.com/ to work as well
This is my current htaccess
<FilesMatch "index.php">
AuthName "Protected Area"
AuthType Basic
AuthUserFile /home/www/.htpasswd
require valid-user
</FilesMatch>
#PIE.htc
AddType text/x-component .htc
RewriteEngine on
RewriteBase /
RewriteCond %{HTTP_HOST} ^subdomain\.mysite\.com$ [NC]
RewriteCond %{REQUEST_URI} ^/subdomain/ [NC]
RewriteRule ^(.*)$ subdomain/$1 [L,R=301,QSA]
#more rules here
And inside the /subdomain folder I simply say
Satisfy Any
Allright ... I got it to work with an external redirect with www.!
RewriteCond %{HTTP_HOST} ^subdomain\.mysite\.com$ [NC]
RewriteRule ^(.*)$ http://www.subdomain.mysite.com/subdomain/$1 [L,R=301,QSA]
Problem with this is, http://subdomain.mysite.com/subdomain/ now redirects to http://www.subdomain.mysite.com/subdomain/subdomain/ - so I setup a php redirect in the subdomain/subdomain/ folder ...
it seems messy but the site is visible when you open subdomain.mysite.com :)

htaccess' rewrite rule keeps redirecting to old domain

I had the following code in my htaccess:
Options -Indexes
RewriteEngine On
RewriteCond %{HTTP_HOST} !^example\.com
RewriteRule (.*) http://example.com/
The main idea was to remove the "www" from the URL because it was giving problems with Facebook apps, but now the domain has changed, so I updated the htaccess, but it keeps redirecting to that old domain, I know that some browsers keep as cache the redirects, so, is there a way to tell the browser to grab this new redirect condition?
Thanks in advance.
Clear your browser's cache and try this :
Options -Indexes
RewriteEngine On
RewriteCond %{HTTP_HOST} !^(www\.)?example\.com [NC]
RewriteRule ^(.*)$ http://example.com/$1 [NC,R=301,L]

Magento non www to www

I am pulling my hair out here.
I have created a landing page which is http://www.pps-supplements.com/samples
it works and you can access it fine - no problems.
If you type in the address bar:
pps-supplements.com/samples
it takes you to the home page which is not good and causing me to have a headache.
My website is working well for non www to www on home page and categories but not on cms pages.
I have read a few posts on here and tried their solutions which is to edit the htaccess file but it hasn't fixed it.
Does anyone have any ideas how I can resolve this issue??
Pretty please!
You could try this in your .htaccess file....
Be sure to add it above any other rewrite rules or conditions you may already have in your htaccess file.
<IfModule mod_rewrite.c>
RewriteEngine On
Rewritecond %{HTTP_HOST} !^www\.pps-supplements\.com [NC]
Rewriterule (.*) http://www.pps-supplements.com/$1 [R=301]
</IfModule>
This will redirect any domain that is not www.pps-supplements.com to the version with www's
Also very handy for using when pointing multiple domains at a site.
Also, be sure that the webserver is set-up to receive the non www version, as in that it is listening for that version, as well as for the version with www's.
For anyone else looking at the accepted answer and running into issues with it not working you may have other Rewrites in place that need to be stopped from executing.
You can stop further execution by including the "L" param.
Example:
Rewritecond %{HTTP_HOST} !^www\.domain\.com [NC]
Rewriterule (.*) http://www.domain.com/$1 [R=301,L]
I wanted to redirect from example.com/category/ to www.example.com/category/
and I found solutions:
turn off Auto-redirect to Base URL in backend
and use this code in .htaccess
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_HOST} ^example.com$ [NC]
RewriteRule ^(.*)$ http://www.example.com/$1 [R=301,L]
</IfModule>
For Magento Multistore-Setups:
Rewritecond %{HTTP_HOST} ^example\.com [NC]
Rewriterule (.*) http://www.example.com/$1 [R=301,L]

Resources