I suppose it depends on how much of your site/server you are taking down and whether you have other/conflicting .htaccess
files elsewhere on your filesystem? But otherwise, if .htaccess
and mod_rewrite is still available then your temporary redirect should work OK. There is no way for a user to bypass those rules unless they somehow hack your server.
Bear in mind that mod_rewrite directives in parent directories can be completely overridden by child directives, further down the filesystem path. For example, if you have a directory /foo
with its own .htaccess
file that uses mod_rewrite (ie. /foo/.htaccess
) then should someone request /foo/bar
your parent mod_rewrite directives will be overridden and the redirect will not occur. For this reason, these directives would be better in the server config - in a vhost or server context - so they cannot be overridden. Or use mod_authz_core/host and customise the response.
However, if this is an existing site that is already indexed by search engines then you should consider sending a 503 Service Unavailable response together with a Retry-After
HTTP response header (indicating the hour of maintenance) - instead of a redirect. This is the preferred response in order to preserve SEO.
See my answer to the following question on the Webmasters stack for more on the 503 response: