Here is my current rewrite code in my htaccess file:

RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
RewriteRule ^ https://www.%1%{REQUEST_URI} [L,NE,R=301]

I would like to add a line that stops the www. forward if the HTTP_HOST is the dev domain for the site.

  • Fake Dev Example: food.example.dev
  • Fake Production Example: food.example
  • Currently the dev domain would redirect to www.food.example.dev
  • food.example should forward to www.food.example
  • but food.example.dev shouldn't forward to www.food.example.dev

What would be a good way to handle this? I have tried a couple different scenarios. I think adding the http to https in there as well might be complicating things because of the [OR].


I think adding the http to https in there as well might be complicating things

Yes, the above (generic) directives are both non-www to www and HTTP to HTTPS. With the way these directives are written you can't have one without the other.

To exclude your dev domain from these directives - which will remove the www and HTTPS redirect from your dev domain then you can simply add an exception (an additional RewriteCond directive) to the top. For example:

RewriteCond %{HTTP_HOST} !^food\.example\.dev [NC]
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
RewriteRule ^ https://www.%1%{REQUEST_URI} [L,NE,R=301]

If the requested host does not start with food.example.dev (your dev domain) then proceed as normal.

However, if you want to still redirect your dev domain to HTTPS, but not www, then you'll need to split your current rule into two.

For example:

# 1. www to non-www (excluding dev domain)
RewriteCond %{HTTP_HOST} !^food\.example\.dev [NC]
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,NE,R=301]

# 2. HTTP to HTTPS (all domains)
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,NE,R=301]

This maintains at most a single redirect. However, if you plan to implement HSTS then you'll need to reverse these two rules and redirect to HTTPS first and potentially get at most two redirects.

You could exclude all requests to your dev domain (ie. all subdomains) by changing the CondPattern to !\.example\.dev. ie. Does not contain .example.dev.

NB: You should first test with 302 (temporary) redirects - to avoid caching issues, and only change to 301 (permanent) when you are sure it's working OK. You will need to clear your browser cache before testing, since the erroneous redirects to www on the dev domain are likely to have been cached by the browser.

|improve this answer|||||
  • I've never redirected capitalized domains before. I don't think you should. Domains are case insensitive. Redirecting is being sensitive about case. My browsers lowercase domains before they are sent to the server. Googlebot lowercases domains before fetching. – Stephen Ostermiller Apr 15 '19 at 14:43
  • @StephenOstermiller Admittedly, a non-lowercase domain name in the request is very much an edge case - possibly an obscure "bot" or devious request (that may not even follow redirects anyway). "Domains are case insensitive." - but with mod_rewrite we are comparing it in a case-sensitive manner, unless we use the NC flag. If we don't redirect the request then we potentially allow the "bot" access to the content via a non-canonical URL, which may be less desirable. If the "bot" does not follow redirects then it gets just a minimal response and we minimise wasting server resources. – MrWhite Apr 17 '19 at 17:08
  • @StephenOstermiller Another option might be to simply block such requests (where the Host header is not all lowercase)? Aside: A bit of an issue with using "generic" directives (as used here) that don't explicitly include the hostname in the substitution string is that we are not actually canonicalising the hostname to all lowercase in the redirect. – MrWhite Apr 17 '19 at 17:12
  • Although, in this case, the use of the NC on the dev domain is to prevent a redirect. (But the dev domain is probably not publicly accessible anyway, so it probably makes no difference at all in this case.) AH, actually, there should be an NC flag on the rule that checks against !^www\. - otherwise there is potential for a malformed redirect! eg. www.WWW.example.com. Again, extreme edge case, but hey... ho hum, I'll update my answer! – MrWhite Apr 17 '19 at 17:32
  • @StephenOstermiller Thanks for the query - made me think more about it, and helped me spot that error! – MrWhite Apr 17 '19 at 17:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.