Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a simple php script. The script is not important. It just prints out $_SERVER.

When I request an URL like www.server.com/?ref=bar everything is fine.

However if the request contains something like www.server.com/?ref=http://www.test.com (?ref=http%3A%2F%2Fwww.test.com) the server redirects to 403.shtml.

No redirect for http://x but redirects http://x.y

As far as I can understand somehow the server doesn't like "http://x". It always redirects to 403.shtml when there is a valid query string in the form of a valid url.

my .htacess file is the same both on my server and local test server and local test server behaves as expected (no redirects). So I don't it is related to .htaccess.

I'm on shared host on Hostgator. Can anyone help?


Here's the .htaccess file

Options +FollowSymLinks

RewriteEngine On
RewriteBase /

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d

RewriteRule ^(.*)$ index.php?$1 [L,QSA]

When there is an http://xx.x it redirects to 403 even if there is physical file. However if I remove the .htaccess redirect to 403 also disappears. But I need the above .htaccess file. Is there a way to get around this?

share|improve this question

migrated from stackoverflow.com Jun 29 '11 at 16:44

This question came from our site for professional and enthusiast programmers.

Your question is not accurate enough : I guess you should post your htaccess as well as having a look on how to set up rewrite conditions here. And make sure your host enabled the rewrite module but this looks like yes from what you said. – hornetbzz Jun 28 '11 at 22:11
up vote 5 down vote accepted

I would guess Hostgator are using the Apache module mod_security, which will block any request that looks like a hacking attempt. You'll either have to change your script so it doesn't pass a URL in the query string or contact them to see if they can tweak their setup.

share|improve this answer
Yes precisely it was an mod_sec issue. Thanks – Sinan Jun 29 '11 at 2:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.