1

Our website will be going down for around an hour or so for maintenance. All users need to be redirected to a page indicating that the website is receiving an update and/or under maintenance.

Will using the following .htaccess rules reliably prevent all users access from the website and reliably redirect all traffic that doesn't match my IP to the maintenance page? i.e. there is no way for anyone to bypass these redirect/rewrite rules?

RewriteCond %{REQUEST_URI} !/maintenance.php$ 
RewriteCond %{REMOTE_ADDR} !^192\.192\.192\.192$
RewriteRule $ /maintenance.php [R=302,L]

1 Answer 1

0

I suppose it depends on how much of your site/server you are taking down and whether you have other/conflicting .htaccess files elsewhere on your filesystem? But otherwise, if .htaccess and mod_rewrite is still available then your temporary redirect should work OK. There is no way for a user to bypass those rules unless they somehow hack your server.

Bear in mind that mod_rewrite directives in parent directories can be completely overridden by child directives, further down the filesystem path. For example, if you have a directory /foo with its own .htaccess file that uses mod_rewrite (ie. /foo/.htaccess) then should someone request /foo/bar your parent mod_rewrite directives will be overridden and the redirect will not occur. For this reason, these directives would be better in the server config - in a vhost or server context - so they cannot be overridden. Or use mod_authz_core/host and customise the response.

However, if this is an existing site that is already indexed by search engines then you should consider sending a 503 Service Unavailable response together with a Retry-After HTTP response header (indicating the hour of maintenance) - instead of a redirect. This is the preferred response in order to preserve SEO.

See my answer to the following question on the Webmasters stack for more on the 503 response:

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .