Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running a CMS using mod_rewrite for pretty URLs, but I have another site running in a subdirectory under the CMS that requires URL rewriting disabled, so I added a couple lines in the .htaccess file:

Options -MultiViews
Options +ExecCGI

AddHandler php5-cgi .php
Action php-cgi /cgi-bin/php-wrapper.cgi
Action php5-cgi /cgi-bin/php-wrapper.cgi

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /

# Added following two lines
RewriteCond %{REQUEST_URI} ^/dir/
RewriteRule ^(.+) - [PT,L]

RewriteCond %{REQUEST_FILENAME} !-f 
RewriteCond %{REQUEST_FILENAME} !-d     
RewriteRule ^(.*)$ index.php/$1 [L]

This works, HOWEVER one of the directories under /dir/ is protected using mod_auth and is still being rewritten. If I take out the Require valid-user directive in the .htaccess file for this directory, everything works great.

Here is the .htaccess file from the protected directory:

RewriteEngine off

AuthType Basic
AuthName "Administration"
AuthUserFile "/home/user/admin/.htpasswd"
require valid-user

Any help would be appreciated. This has been bugging me for weeks! I did some Googling and others have had this problem, but I haven't found a solution.

share|improve this question
Just a note that when I say it "works" after removing Require valid-user, I mean the redirection works, but my directory is of course no longer protected. – Michael Mior Aug 18 '09 at 12:25
up vote 7 down vote accepted

I had the same problem, Michael, and finally found the solution

For basic authentication, the server writes a "401 Unauthorized" header and then looks for an error document based on a pre-defined path. Most of the time, the error document won't exist in the directory that you want to protect, so the request gets handled by the rewrite engine which throws a 404 error.

The solution to this problem is pretty straightforward. You need to add a single line of code to your .htaccess file instructing Apache to ignore the error document. When you're done, the code should look something like this:

ErrorDocument 401 "Unauthorized Access"

RewriteEngine off

AuthType Basic
AuthName "Administration"
AuthUserFile "/home/user/admin/.htpasswd"
require valid-user

Hope that works for you!

share|improve this answer
YES! Thanks so much. I ended up finding a workaround, but it was one of those problems that kept on bugging me. Anyway, this solution worked like a charm :) – Michael Mior Sep 11 '09 at 11:43
This drove me crazy for a while. RewriteEngine off by itself worked. The password lines by themselves worked. But combine the two and you get 404s. Thanks! – Costa Jul 29 '14 at 21:53

I'd try to enclose the Rewrite statements into a <DirectoryMatch> statement next. You could simply use it with inverse logic to match every directory but the one that should not be rewritten:

<DirectoryMatch "^/(?!dir)">
    RewriteEngine on
share|improve this answer
Sorry, I should have pointed out that this is on a shared hosting account, so I can't modify httpd.conf. DirectoryMatch is not allowed within .htaccess. I did try it anyway, and no luck. – Michael Mior Aug 18 '09 at 12:19

Alternatively to Manni:

RewriteCond %{REQUEST_URI} !^/dir/
RewriteCond %{REQUEST_FILENAME} !-f 
RewriteCond %{REQUEST_FILENAME} !-d     
RewriteRule ^(.*)$ index.php/$1 [L]

and ditch the two rules you added (assuming I've understood the problem correctly), and remove the RewriteEngine from the protected .htaccess.

share|improve this answer
This was what I initially tried. This does not work. – Michael Mior Aug 18 '09 at 12:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.