2

I'm currently using my .htaccess to force all HTTP requests to HTTPS, and that is working very well. However I would also like to redirect some TLDs. For example -

http(s)://(www.)example.info -> https://example.com or https://www.example.com

http(s)://(www.)example.net -> https://example.com or https://www.example.com

My current .htaccess file contains:

RewriteOptions inherit

RewriteEngine on
RewriteCond %{HTTPS} !on
RewriteCond %{REQUEST_URI} !^/[0-9]+\..+\.cpaneldcv$
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

The incoming requests that I would like to redirect from may or may not be HTTPS, and the "www" may or may not be present.

The other thing I'd like to do, and sorry if this should be in a separate question but I believe that the answers would be related....

Can I wrap the previously described redirects in a conditional that will skip them if the server is localhost?

5
  • What is your RewriteOptions inherit directive for?
    – MrWhite
    Apr 20, 2018 at 22:34
  • I believe that it was automatically placed there via cPanel and I left it in and added it to the example in case it had some affect on any answers.
    – jxmot_wd
    Apr 25, 2018 at 8:17
  • RewriteOptions Inherit "inherits" mod_rewrite directives from a parent config (by literally copying them to the end of your current .htaccess file). This could be relevant, particularly since you don't have an L flag on your original directives. This directive shouldn't normally be required, especially if you don't actually know what it's doing. However, some hosts might require this.
    – MrWhite
    Apr 25, 2018 at 10:31
  • I think I might know how it got in to the .htaccess file. Originally the site was hosted under a parent domain/account. Then a new cPanel account was created for it and the files were copied over. In its original location it was located in ~/public_html/example and ~/public_html also had an .htaccess file. If I understand you correctly it's likely that RewriteOptions Inherit is no longer necessary.
    – jxmot_wd
    Apr 26, 2018 at 18:47
  • Yes, RewriteOptions Inherit is probably not required anymore.
    – MrWhite
    Apr 26, 2018 at 21:07

1 Answer 1

1

http(s)://(www.)example.info -> https://example.com or https://www.example.com

On reading your question it doesn't sound like you want to canonicalise the www subdomain? However, you should be. Decide whether it should be www.example.com or example.com and stick to that. For the rest of this answer, I'll assume www.example.com should be the canonical domain.


The easiest way would be to say... if the request is not for the canonical domain then redirect to the canonical domain. This will then catch any of the other TLDs and whether they are www or not (and even whether they are FQ or not).

For example:

RewriteCond %{HTTPS} !on [OR]
RewriteCond %{HTTP_HOST} !=www.example.com
RewriteRule .* https://www.example.com%{REQUEST_URI} [R=301,L]

Notes about the above:

  • Addition of the OR flag on the first condition. So either of the first two conditions must be successful (not just both of them).
  • The = prefix defines a lexicographical exact string comparison. ie. not a regex. So no need to escape literal dots or use start/end-of-string anchors.
  • Removal of the parentheses on the RewriteRule pattern. No need to capture anything, since you aren't using it.
  • Added the flags on the RewriteRule. This should ultimately be a 301 permanent redirect, although first testing with a 302 temporary redirect (to avoid caching) is preferable. If you ever add more directives then you will need the L flag to stop further processing.
  • Add back the two cPanel additions if you wish (required for AUTO-SSL renewal). Or these can be separated into their own rule.

Can I wrap the previously described redirects in a conditional that will skip them if the server is localhost?

There are quite a few ways to block the directives from local development (which can depend on your server config / version). If you simply want to block this single mod_rewrite rule from applying to the Host localhost then just add another condition:

RewriteCond %{HTTPS} !on [OR]
RewriteCond %{HTTP_HOST} !=www.example.com
RewriteCond %{HTTP_HOST} !=localhost
RewriteRule .* https://www.example.com%{REQUEST_URI} [R=301,L]

ie. Only when the Host header is not "localhost".


Summary

So, in summary, adding back the cPanel conditions (for AUTO-SSL renewal), we have:

RewriteOptions inherit

RewriteEngine on
RewriteCond %{HTTPS} !on [OR]
RewriteCond %{HTTP_HOST} !=www.example.com
RewriteCond %{HTTP_HOST} !=localhost
RewriteCond %{REQUEST_URI} !^/[0-9]+\..+\.cpaneldcv$
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
RewriteRule .* https://www.example.com%{REQUEST_URI} [R=301,L]

However, also note the comment by @xsrf if you are planning on implementing HSTS.

See also my answer to the following ServerFault question for more information regarding those additional directives (AUTO-SSL renewal) added by cPanel:
https://serverfault.com/questions/884915/apache-htaccess-multiple-rewrite-conditions-for-multiple-rules

6
  • 1
    For best practice, you should redirect to https:// first on the same host, then redirect to the preferred host. This is important if you use security features like HTTP Strict Transport Security (HSTS). Only this way the HSTS setting will be remembered for all domains by the browser.
    – xsrf
    Apr 21, 2018 at 8:30
  • @MrWhite Sorry about not replying sooner. I've been able to get the .info and .net to successfully redirect to .com. Thank you! However I'm not sure if I've added the AUTO-SSL stuff correctly,
    – jxmot_wd
    Apr 25, 2018 at 8:39
  • @jxmot_wd You literally just need to copy those two RewriteCond directives back to the same place; immediately before the RewriteRule directive. I've updated my answer.
    – MrWhite
    Apr 25, 2018 at 10:33
  • @MrWhite Thank you very much for updating the answer, as it turns out my "guess" was correct. Thanks again for your time and excellent explanations. I'm now aware of things that I didn't before.Like HSTS for example, I did some reading about it and found that it can be enabled by adding Header set Strict-Transport-Security "max-age=31536000" env=HTTPS to .htaccess. However I'm a bit unclear in regards to its location in the .htaccess file. My guess is that it would be the first line in the file.
    – jxmot_wd
    Apr 26, 2018 at 18:40
  • @MrWhite I did follow your advice regarding "www", thank you!
    – jxmot_wd
    Apr 26, 2018 at 18:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.