".HTACCESS" WORKOUT - HOW TO DO BACKFLIPS WITH YOUR WEB PAGES

If you don't know what an ".htaccess" file is, click here for a complete rundown.

If you've said "yes" to any of the above questions, the answer to your problem is the ".htaccess" file. Even if you haven't said "yes" to any of the above questions but you own or operate a website, chances are you'll think what follows is pretty cool.

It's worth pointing out that ".htaccess" files are useful for much more than the three situations outlined above. You can use .htaccess files to do a raft of useful web-tricks. For a much more complete outline of what you can do, click here. To get a Reader's Digest condensed version of what you can do, read on.

Redirecting from an old page to a new page

There may come a time when you need to redirect certain requests to another URL. For example, you've published an ad somewhere and it contains a typo. Or you've renamed or moved part of your web site. To redirect a specific request you only need to add a single line to your .htaccess file:

Note that the first value after the Redirect command is the requested file, without the domain name, but the second value is a complete URL. In this example, if someone tried to access "http://mysite.com/oldpage.html" they would be redirected to "http://mysite.com/newpage.html".

By default this command will use a "302 temporary" error code to redirect the visitor. You can optionally insert the keyword "permanent", "temp", "seeother", or "gone" after the Redirect command to return a "301 permanent", "302 temporary", "303 see other", or "410 gone" status (when returning a "gone" status you should leave out the new URL).

Preventing Image Theft

If you have images on your site that are useful to others, they may link them into their own pages without your knowledge. This means that when anyone views their web site, the images themselves will be downloaded from your site! You can prevent this by ensuring that the "referer" (that's the URL of the web page that referenced the images) is your own and not somebody else's. You can do this by adding these lines to your .htaccess file:

SetEnvIfNoCase Referer "^https?://(www\.)?example.com/" ok=1
SetEnvIfNoCase Referer "^$" ok=1
<FilesMatch "\.(gif|png|jpe?g)$">
order allow,deny
allow from env=ok
</FilesMatch>

The first line checks to see if the referer (yes I know that's spelled wrong, but that's the official name for it) is "www.example.com" or "example.com" (you would, of course, change this to reflect your own domain name). If it is, it sets the variable "ok" to "1". The second line looks for a blank referrer and allows that as well. Then we have a set of limit rules enclosed in a <FilesMatch ...>" section that only allow access to image files (.gif, .png, .jpg, or .jpeg) if the variable "ok" s set to "1".

A more detailed description of this is available here.

Note that it is possible to do something similar by way of the "mod_rewrite" mechanism (also done via .htaccess files), but this is less portable (not all sites support mod_rewrite) and it's also less efficient.

Restricting Access to Certain Files

It is sometimes necessary to place a file in your web space that isn't meant for public viewing. For example, a PHP script may store a database username and password in a file, and you wouldn't want people to load that file directly. You can block access to specific files via your .htaccess file like this:

<Files database.conf>
order allow,deny
deny from all
</Files>

Note the "order" and "deny" commands. The key thing to note here is that the limiting rules are enclosed in a pair of "Files" tags. The opening tag indicates the file(s) that the following block of rules will apply to. In this example, we are blocking access to the file named "database.conf".

This only blocks people "on the outside" from accessing that file. Your CGI scripts are not bound by .htaccess files and can access the files, as can FTP, etc.

It is fairly common to block access to any files that start with ".ht" (like the .htaccess file itself). In fact, the web server itself does this by default using something like this:

<Files .ht*>
order allow,deny
deny from all
</Files>

Note how you can use the '*' wildcard in filenames. More complex pattern matching can be done with the <FilesMatch ...> tag, which works the same way except that it uses regular expressions instead of simple wildcards.