Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have this simple mod_rewrite rule in my .htaccess, and both my browser tools (Firebug and Web Dev Toolbar) and my apache logs are showing the server returning a 404 instead of 403. Just wondering if this is normal, and if not, what can I do to remedy it?

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteCond %{REMOTE_ADDR} !^(192\.168\.0\.11|192\.168\.0\.161)$
    RewriteRule ^(admin|login\.php) - [F]

Server replies:

GET login.php 404 Not Found

Log file shows:

(404) (Request:) "GET /login.php HTTP/1.1"


One more thing. Should I include the [L] last flag after the [F] forbidden? e.g. [F,L] Thanks! :)


The files in question most definitely exist. When I change the IP address to allow myself access, I am able to http to them with no problem. Also, when I change the [F] to [G], the expected server response (410 Gone) is returned.

share|improve this question
do you have any custom error pages? – JamesRyan Oct 6 '09 at 15:19
I was just thinking about custom error pages. Each of my vhosts has this: ErrorDocument 401 /404.php, ErrorDocument 403 /404.php, ErrorDocument 404 /404.php. Each error points to 404.php, but does that have anything to do with the ACTUAL error returned by the server? – Jeff Oct 6 '09 at 15:23
That is ABSOLUTELY the problem. The file 404.php does not exist. Lol. – Jeff Oct 6 '09 at 15:26
up vote 1 down vote accepted

As it turns out, my apache2 vhost has the following ErrorDocument directives:

ErrorDocument 401 /404.php
ErrorDocument 403 /404.php
ErrorDocument 404 /404.php

... and the 404.php file does not exist (purposely). When 403 is commented out, [F] works as expected.

share|improve this answer
You should mark your own answer as accepted. – Dan Carley Nov 11 '09 at 11:02

It certainly shouldn't do.

Are you sure that the condition and rule are matching? Does login.php really exist?

If you have no other RewriteRule's then there's not much sense/difference in using an [L] flag.

share|improve this answer

I don't think that your rewrite rule is matching. I would break it down and check your rewritecond and rewriterule seperately.

share|improve this answer
Yes, it is most definitely matching because when I change the IP address to allow myself to the files in question, I am allowed access. – Jeff Oct 6 '09 at 14:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.