4

I would like to disable direct access to all PDF files except those with a public- prefix on the beginning on the file name (e.g., public-samplepdf.pdf) so they can be viewed in public. I'd like to redirect all other PDF files to my home page.

Here is .htaccess code that I have tried, but it isn't working. What should I be doing instead?

RewriteRule ^(.+/)?public-(.*) /redirect-url/ [R=301,L]
  • What do you want to happen when someone requests a file that doesn't have the public- prefix in the name, go to a 404 not found error page? Have you thought about adding password protection instead for files that shouldn't be available to the public? In other words, why have files on a server if you don't want to serve them? – dan Sep 25 '18 at 2:46
  • i would like to redirect all pdf file that doesn't have public prefix – Dherell Sep 25 '18 at 2:48
  • Again, where do you want them redirected to? – dan Sep 25 '18 at 2:49
  • 1
    Some of file are public but theirs a files cannot be access. but when you logged in all file are accessable now – Dherell Sep 25 '18 at 2:49
  • i want to redirect them to home page of my site – Dherell Sep 25 '18 at 2:49
3
RewriteRule ^(.+/)?public-(.*) /redirect-url/ [R=301,L]

This would seem to do the opposite (sort of) of what you are trying to do. It redirects any URL that contains the string "public-". It needs to match any URL that does not start "public-" in the last path segment and also ends with .pdf.

Also, this should not be a 301 (permanent) redirect, otherwise, users who have previously visited these URLs and been redirected will find it hard to visit the URL when they are authorised to do so (but see note below[*1]).

You can negate regular expressions in mod_rewrite simply by prefixing them with !. So !foo would match any URL that does not contain "foo".

Try the following instead, to redirect all non-public .pdf files to the home page:

RewriteRule !^(.+/)?public-[\w-]\.pdf$ / [R,L]

This unconditionally redirects every URL that does not match the given pattern. The character class [\w-] matches the characters a-z, A-Z, 0-9, _ and -. So, only alphanumeric characters plus underscore and hyphen are permitted in your PDF filenames.

If it should only redirect requests that would map to an actual file then you need an additional condition (if you are placing these directives at the top of the file). For example:

RewriteCond %{REQUEST_FILENAME} -f
RewriteRule !^(.+/)?public-[\w-]\.pdf$ / [R,L]

Or, place these directives after the WordPress front-controller.

Some of file are public but theirs a files cannot be access. but when you logged in all file are accessable

[*1] Although I don't know how you were hoping to implement that when you are unconditionally redirecting all these requests in .htaccess?


Bit of an aside, but ... you shouldn't normally "block" requests by redirecting to the homepage. And nor would you use mod_rewrite to block access to specific files on the filesystem. mod_rewrite in .htaccess primarily deals with URLs, not filesystem paths.

To specifically block access to .pdf files (ie. serve a 403 Forbidden), but allow public- .pdf files then you would use mod_authz_core (Apache 2.4+) inside a <FilesMatch> container. For example:

<FilesMatch "^(?!public-).+\.pdf$">
Require all denied
</FilesMatch>

The above regex uses a negative lookahead to match all .pdf files that do not start with "public-".

  • Good breakdown and explanation. – dan Sep 26 '18 at 3:22

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.