Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Ok, so I have an Apache host I'm working on (shared host) who has this in their root .htaccess file.:

Options -Indexes

SSLOptions +StrictRequire

ErrorDocument 401 "<!DOCTYPE html><html lang='en'> ... "
ErrorDocument 403 "<!DOCTYPE html><html lang='en'> ... "


So when a user tries to connect without SSL, they are prompted with the custom 403 html listed in the file. This occurs while keeping their old URL in the address bar so they can just add the https quickly.

However, for error page improvements, it is desired to load a php file from ./error and use that file in the definition for ErrorDocument. Now this is the kicker, if one just specifies the document directly...

ErrorDocument 403 /error/script.php

They will get another 403 or Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request. since the connection to the file is not under SSL. In an attempt to fix that, one may try this...

ErrorDocument 403 https://site.tld/error/script.php

But that redirects the client to https://site.tld/error/script.php which is UNDESIRED because they have to retype the url, and thus unable to just change the http to https.

So, I imagine I must do one of the following:

  • EXCLUDE ./error from the SSL requirement with some .htaccess handling OR
  • Build a REWRITE rule that detects the use of an error page, and doesn't rewrite the URL

I was unable to do either of this things yesterday. Perhaps neither of those options are viable, but I'm stuck at what to do.

How can I instruct .htaccess to allow http connections in ./error, or some other fix, so I still get my error pages, but the client still keeps their original URL?

share|improve this question
up vote 0 down vote accepted

Ok, here is my fix for now.

I have a folder structure as follows:

/ (web root)
|- .htaccess
|- index.php
|- error
|- dir1
|- dir2
|- dir(n - 1)
`- dir(n)

In (web root).htaccess I have the following:

Options -Indexes

ErrorDocument 403 /error/script.php

And within ANY subdir's folder (EXCEPT FOR /error/):

SSLOptions +StrictRequire

This allows me to load error pages without SSL, but still enforce it for every other folder. Is it pretty? No, I'd like to be able to control this from the root's .htaccess. But this is the only thing I have gotten to work so far.

If you can find a better solution, please post your work here.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.