Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to create a rule set in .htaccess which would treat a URL differently depending on the HTTP_REFERER value. Something is not working as expected, and I'm not sure if the problem is syntactic or logical.

In simple terms, for all files under a specific directory I want them to be served straight up if the HTTP_REFERER is from the same domain, or redirect to a script if it's blank or other domain. What I have:

RewriteCond %{HTTP_REFERER} !^https://%{HTTP_HOST}.*$
RewriteRule ^/mydir/(.+)$ /incl/serve_content.php?c=$1 [L]

The site is HTTPS only, so the https in the condition should be enough. What I get though is that the rule never seems to match. What am I missing?


After more debugging, it looks like this rule does not even get checked, there is no mention of neither match nor no-match in the log file created by the RewriteLog directive. Why wouldn't it check it it?

Edit The complete contents of the .htaccess file:

ErrorDocument 404 /incl/404.php

AddType application/octet-stream .csv
AddType application/vnd.openxmlformats-officedocument.spreadsheetml.sheet .xlsx

RewriteEngine On

RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R,L]

RewriteCond %{HTTP_REFERER} !^https://%{HTTP_HOST}.*$
RewriteRule ^/mydir/(.+)$ /incl/serve_content.php?c=$1 [L]

RewriteBase /
RewriteRule ^final/([A-Za-z0-9_\.]+)$ incl/serve_final.php?c=$1 [QSA]
RewriteRule ^quiz/([A-Za-z0-9_\.]+)/([0-9]+)$ incl/serve_quiz.php?c=$1&q=$2 [QSA]
share|improve this question
Is it correct that you only want a redirect to occur if the HTTP_REFERER is the current site (HTTP_HOST) running on https? or are you trying to handel third party referrers ? – Oneiroi Jul 12 '12 at 16:03
I only want to redirect third party or empty referrers. – SaltyNuts Jul 12 '12 at 17:19

When you're working with mod_rewrite, the most important directives you have is

 RewriteLog /path/to/apachelogs/rewrite.log
 RewriteLogLevel 9

This will give you a huge amount of debug information. If you add those lines and then look at the debug log, you should find exactly what is going on and hopefully get some hints to why.

share|improve this answer
Thanks for the tip. It looks like the condition is not being checked at all. I have another rule in the same file (for forcing https) and I can see how it's being checked in the log file, but nothing about this rule. Hm... – SaltyNuts Jul 12 '12 at 17:41
Can you post all your rewrite rules in the order they appear in the config file? There may be clues there. – Jenny D Jul 12 '12 at 19:14

The rule will never match because you're using a leading slash in an .htaccess file. Try this instead:

RewriteRule ^mydir/(.+)$ incl/serve_content.php?c=$1 [L]

By the way, if you have access to the server config, you shouldn't be using .htaccess.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.