htaccess
-.htaccess Snippets phanan/htaccess
https://github.com/h5bp/html5-boilerplate/blob/master/dist/.htaccess
See also Pre compress assets, GZip - Deflate
Authorized access
Require all grantedhttp://httpd.apache.org/docs/current/mod/mod_authz_core.html#require
Module identifier
Smart serve image formats
Note: It's not recommended to use that way but <picture>: The Picture element - HTML: Hypertext Markup Language | MDN.
# Check if Accept header is image/webp, if an image is requested in "classic" folder with a classic format, and check if the corresponding webp image exists. If yes, rewrite the requested classic image URI to the WebP image URI.
RewriteCond %{HTTP_ACCEPT} image/webp
RewriteCond %{REQUEST_FILENAME} (.*)images/classic/(.*)\.(png|jpg|gif)$
RewriteCond %1images/webp/%2\.webp -f
RewriteRule .* images/webp/%2.webp [L]Auto compress
For PHP, which return text/html it handled with AddOutputFilterByType
An other version:
https://gist.github.com/FlorianKromer/aa08762387183404a506#file-htaccess-L101-L178
Content handling
Media type
Use header Content-type
See also Media type
Documentation and editors
http://www.htaccesseditor.com/en.shtml http://www.thejackol.com/htaccess-cheatsheet/ http://alexking.org/blog/2007/08/30/friendly-search-urls http://www.webrankinfo.com/analyses/autres/url-rewriting-debutants.php http://www.sitepoint.com/article/guide-url-rewriting/4
http://httpd.apache.org/docs/2.0/mod/mod_rewrite.html
HSTS
And redirect HTTP to HTTPS
See HSTS
You should add a mecanism to redirect HTTP to HTTPS too. It's adviced to use VirtualHost:
Detect how to know if it's HTTPS with PHP https://github.com/rlankhorst/really-simple-ssl/blob/master/ssl-test-page.php
CORS
Rewrite / redirect
From Symfony https://github.com/symfony/symfony-standard/blob/master/web/.htaccess, see also .htaccess - What Double Colon does in RewriteCond? - Stack Overflow:
and use Base
Logging - mod_rewrite - Apache HTTP Server Version 2.4 Debug
LogLevel rewrite:trace8mod rewrite - mod_rewrite not sending Vary: accept-language when RewriteCond matches - Stack Overflow - "header name will not be added to the
Varyresponse header if it is not sent by the client."
Cookies
Set cookie
Get cookie
Rewirte base on cookie
Redirect if cookie not set
Environnement variables
Pass variable to script
Pass env variable to PHP, should start with HTTP_, eg. $_SERVER['HTTP_MY_VARIABLE']:
Or use query param
Echo all header back
Caching
ETag removal
https://gist.github.com/FlorianKromer/aa08762387183404a506#file-htaccess-L180-L241
Serve pre-encoded resources
Aka serve precompressed files
This limitation of
mod_deflateis prominently mentioned in the documentation, which recommends usingmod_rewriteto rewrite requests to their compressed alternatives when appropriate. Although this method can work [...] it has the major drawback that you are reimplementing content negotiation (whichmod_negotiationwas designed to do) and are likely to get it wrong and lack features supported bymod_negotiation. Some common problems and pitfalls with this approach:
Sending an incorrect or missing
Content-Encodingheader.Not sending the
Varyheader or setting it incorrectly (overwriting previous values for other headers which cause the response to vary).Sending
Content-Type: application/x-gzipinstead of the underlying type.Sending double-gzipped content due to forgetting to set
no-gzipin the environment to exclude the response frommod_deflate.Not respecting client preferences (i.e. quality values/qvalues). According to RFC 7231 (and RFC 2616 before it) clients can send a numeric value between 0 and 1 (inclusive) to express their relative preference for each encoding. An
Accept-Encoding: gzip;q=0header would signify that the client wants “anything but gzip”. Mostmod_rewriteimplementations would send them gzip. A more realistic example would be a client that sendsAccept-Encoding: br;q=1, gzip;q=0.5, deflate;q=0.1to signify that they prefer Brotli, then gzip, then deflate. Writingmod_rewriterules which properly handle these sorts of expressed preferences is extremely difficult.
Serving pre-compressed content mod_deflate - Apache HTTP Server Version 2.4
Serve pre-encoded resources with mod_rewrite
mod_rewriteServe pre-encoded resources with MultiViews
MultiViewsMultiViewscomes frommod_negotiation
To handle content encoding.
MultiViews allow to list all files (recognized by mod_mime) in the same folder for the given name:
You need to restrict content negotiation by include directives in a <Directory>, <Files> or .htaccess for a subset of directories, file types.
The major drawback, only requests for files which do not exist are negotiated. That means you need to rename uncompressed files for an additional extension (ex: index.html.html and index.html.gz for https://example.com/index.html) which is not pratical.
Precompressed files and type maps
type mapscomes frommod_negotiation
Exemple, for test.html test.html.gz and test.html.br, create a file test.var, for a request /test
Variables
.htaccess:
index.php:
getenv,putenv,apache_getenvandapache_setenv
Other
From drupal:
Special chars with RewriteRule
RewriteRuleEx: a file or folder named tést $a? (te%CC%81st%20%24a%3F) is translated internaly to te\xcc\x81st $a (discarding handling ?)
Potential solution: use flag B or double URL encoding ?
Bots
Or
Or use robot.txt
To get the list: add a honeypot URL, or use wp-login if it's a Wordpress website (but it will including you and others humans admin/users)
https://github.com/serbanghita/Mobile-Detect/blob/c08a459521496f2925c3dcb186a910f5b8d7e336/Mobile_Detect.php#L554
Last updated
Was this helpful?