75

With apache2, just run a2enmod headers and then sudo service apache2 restart and it will install the headers module automatically.


40

If you are "shutting down a site" then you probably should not be "redirecting" the old site pages to a single page. An HTTP redirect sends a 301 response code, informing users and search engines the pages have moved. (Although mass redirects to a single page are likely to be seen as soft-404s by Google.) Instead, you should be serving a ...


28

You need to configure your apache to enable configuration from the .htaccess file. So in the directory section be sure you have the option Allowoverride ALL for more information more information about allowoverride. In your setup if you use only mod_rewrite maybe you can set only FileInfo , I always set the Options parameter to SymLinksIfOwnerMatch to ...


22

The answer to your question is contained within the error message. The right thing to do in this case would be to smack whoever wrote that line, and make a list of each option specified. If it appears with a minus at all, put it in once with a minus. If it appears only bare or with a plus, put it in once with a plus. I believe you just want this: ...


22

The recommendation from the Apache project is: In general, you should only use .htaccess files when you don't have access to the main server configuration file. ... a common misconception is that user authentication and mod_rewrite directives must go in .htaccess files. So please both set AllowOverride None and all your other directives in the main httpd....


18

<If> is only available in Apache 2.4+, so firstly make sure that you have that version. Examples # Compare the host name to example.com and redirect to www.example.com if it matches <If "%{HTTP_HOST} == 'example.com'"> Redirect permanent "/" "http://www.example.com/" </If> <If "%{HTTP_HOST} =~ /regex/"> SecFilterEngine Off ...


18

Apache 2.4 comes with some security enhancements that attempt to make it more difficult for hackers to hide their files on a compromised system. This behaviour is explained more at: http://httpd.apache.org/docs/2.4/upgrading.html#access A quick easy fix is to add a directory rule to your main apache config file (/etc/apache2/apache2.conf by default on ...


17

The difference between http and https is that https requests are sent over an ssl-encrypted connection. The ssl-encrypted connection must be established between the browser and the server before the browser sends the http request. Https requests are in fact http requests that are sent over an ssl encrypted connection. If the server rejects to establish an ...


15

This should work just fine: RedirectMatch 301 ^/$ https://example.com/


15

HTML5 Boilerplate (http://html5boilerplate.com) offers what seems to be the best and most effective solution setting along with plenty of others like caching, mime types etc. Highly recommended. <IfModule mod_deflate.c> # Force compression for mangled headers. # http://developer.yahoo.com/blogs/ydn/posts/2010/12/pushing-beyond-gzipping <IfModule ...


15

You'll need to add a line like: LoadModule headers_module modules/mod_headers.so To your httpd.conf to add support for that. In Ubuntu and similar, you can do a2enmod headers and it'll automatically enable it in your configuration.


15

Thanks to HBruijn's comment, I understood why I was getting the redirect loop. The traffic from the ELB will always be HTTP as it handles the HTTPS traffic to the user but to the server it's HTTP, so my previous rule will result in a loop. After some research I found that the load balancer forwards a few userful headers like X-Forwarded-Proto. This can be ...


15

The following should work: Header set Content-Security-Policy "default-src http://domainA.com; \ script-src http://domainB.com"


12

I suspect that the apache user isn't capable of reading /home/janeb/.htpasswd. Check Apache's error log. That's the only thing I see wrong in the config that's provided, but that might not be the only problem; please provide your full virtual host config. I'd also recommend that you move the authentication config out of the .htaccess file - there's no ...


11

Wordpress's .htaccess file sends all non-existing files and directories to be processed by Wordpress. Try excluding the server status urls too. RewriteRule ^index\.php$ - [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_URI} !=/server-status RewriteRule . /index.php [L]


11

The Apache Directory directive on /var/www/ninja/www/ only allows modification of the behaviour of FileInfo Indexes by way of the .htaccess file. Refer to the Apache documentation on AllowOverride. Please modify the AllowOverride to also allow the local configuration of AuthConfig resulting in: <Directory /var/www/ninja/www/> Options Indexes ...


11

You only need the RequireAny condition: <RequireAny> and </RequireAny> are used to enclose a group of authorization directives of which one must succeed in order for the <RequireAny> directive to succeed. <RequireAny> Require ip 1.1.1.1 Require valid-user </RequireAny>


11

All this rule does is to add a trailing / to your URLS if there is none and if there is no . in the URI, so https://example.org/test will be redirected to https://example.org/test/, but https://example.org/test.html will not be rewritten to https://example.org/test.html/ (but note: https://example.org/test.case/folder will also not be redirected to https://...


10

Use %{HTTP:X-FORWARDED-FOR} instead of %{REMOTE_ADDR}


10

It conflicts with the rule RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ index.php [QSA,L] at the end of the .htaccess file. If I add an exception for index.php like RewriteCond %{HTTP_HOST} ^www.domain.example$ [NC] RewriteCond %{REQUEST_URI} !^/test$ RewriteCond %{REQUEST_URI} !index.php RewriteRule ^(.*)$ http://www.example.org/foo/ [R=302,L]...


10

First of all: my pet peeve, quoted from from the manual on .htaccess files: You should avoid using .htaccess files completely if you have access to httpd main server config file. Using .htaccess files slows down your Apache http server. Any directive that you can include in a .htaccess file is better set in a Directory block, as it will have the same ...


10

You should configure Apache Virtualhosts to do the job. RewriteMod isn't the appropriate solution for this case and .htaccess isn't either. In your httpd.conf or equivalent use the following lines accordingly your needs. Edit it to your domain and site. <VirtualHost *:80> ServerName www.example.com example.com Redirect permanent / https://...


10

As noted on the HSTS preload list submission requirements: Redirect from HTTP to HTTPS on the same host, if you are listening on port 80. You need to redirect to the same host (ie. HTTP_HOST), not simply to example.com first. You don't need to redirect to example.com if the user is requesting www.example.com directly. (The test will involve a request to ...


9

I enabled deflate on static assets on my site (by MIME type) using the following added to the .htaccess file at the root of my public_html directory: <ifModule mod_deflate.c> AddOutputFilterByType DEFLATE text/html text/xml text/css text/plain AddOutputFilterByType DEFLATE text/javascript application/javascript application/x-javascript application/...


9

@Simbus82 is right about inverting the rules. Here is an approach that is slightly more universal. RewriteEngine On # ensure www. RewriteCond %{HTTP_HOST} !^www\. [NC] RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301] # ensure https RewriteCond %{HTTP:X-Forwarded-Proto} !https RewriteCond %{HTTPS} off RewriteRule ^ https://%{HTTP_HOST}%{...


9

You cannot do this because you can only see cookies from the domain that your site is on. The browser will NOT send you any cookies from other domains.


9

This is the standard nginx behaviour for this part of your configuration : location /upload { if ($http_referer !~ "^http://(.+\.)?foo\.com/"){ rewrite .*\.(jpe?g|gif|bmp|png)$ /nohotlink.gif break; } location ~ \.(php|sql|php3|php4|phtml|pl|py|jsp|asp|htm|shtml|sh|cgi)$ { deny all; } } Why? Let me clarify how ...


9

Apache 2.4 makes some big changes in the way it authorizing users. Authorization components in Apache 2.4 can now use the Require syntax that was previously only available for authentication. This change simplifies the way to define authorization order. The rule sets previous to 2.4 rather could geth pretty complex. The rules in 2.4 are a more logical, ...


9

This is another acceptable syntax for .htaccess file: <RequireAll> Require all granted Require not ip 50.62.136.183 </RequireAll> This syntax is recommended for 2.4 because the order-deny syntax will not always work, as can be seen here http://httpd.apache.org/docs/2.4/upgrading.html


9

Because the second argument to both the RewriteCond and SetEnvIfNoCase directives are regular expressions (regex), not ordinary strings. Regex use a special syntax to define search patterns. In regex syntax, the dot/period is a special (meta) character that represents any character (except newlines by default). In order to match a literal dot (ie. disable ...


Only top voted, non community-wiki answers of a minimum length are eligible