Due to a security vulnerability in Wordpress, a bunch of my posts got renamed to something like:


I've since fixed the problem, upgraded Wordpress, and also upgraded my Web server to Apache 2.2.3. The problem is, now I have a bunch of URLs that are indexed in Google and linked to from other sites. Google will eventually remove them from their index, but in the meantime I want to rewrite the bad URLs to correct URLs.

I've tried the following mod_rewrite rule, but it doesn't seem to work. It seems like Apache is seeing the request as "bad" and just returning an HTTP 400 error without ever consulting mod_rewrite (or mod_redirect). Here's the rule I've tried:

RewriteRule ^(20[0-9]{2}/[0-1][0-9]/[0-3][0-9]/[^/]+)/.*base64.*$ http://***MYSITE***/$1 [L,R=302,QSA]

Which matches when I test it in a regular expression tool, but doesn't seem to make any difference to Apache. Has anyone come across this problem? Any possible solution?




You could define a custom ErrorDocument for the 400 Errors like so:

ErrorDocument 400 /cgi-bin/handle400.cgi

and then have that cgi (or php or servlet or whatever) do the header rewriting and location redirecting.

EDIT: because of Jacek's answer I just tested above solution to confirm it works on Apache 2.2.

My Server Config:

ScriptAlias     /cgi-bin/ "/var/www/cgi-bin/"
ErrorDocument   400 /cgi-bin/handle400.pl

lukas$ cat /var/www/cgi-bin/handle400.pl

print "Content-type: text/html\n\n";
while (my ($key, $val) = each %ENV) {
        print "$key = $val<BR>\n";
exit 0;

Now when accessing the broken URL that would produce an error 400 Bad Request before, I now get the following (partial) output:

REMOTE_ADDR = xx.xx.xx.xx
REQUEST_URI = /%&%28%7B$%7Beval%28base64_decode%28$_SERVER%5BHTTP_EXECCODE%5D%29%29%7D%7D%7C.+%29&%/
SCRIPT_URL = /cgi-bin/handle400.pl

So you do get enough information to do a proper status code change and location redirect.

  • Thanks! I had tried this method, but somehow managed to not get it working. I gave it another shot and it worked like a charm. – inxilpro Mar 8 '10 at 17:24

'400 Bad request' means the request is so broken it cannot be parsed/understood by the server. That means the server has no data from the request (even the URL), so there is nothing mod_rewrite, or any other tool handling request data, can do about it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.