1

I am confused about both the purpose of .well-known exceptions and so many conditions. Is this just something temporarily put in place by the host or is it best practice to keep it in place? Why are there two sets of conditions and rules. Can they be combined into one set?

RewriteEngine On
RewriteCond %{SERVER_PORT} 80 
RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/[0-9a-zA-Z_-]+$
RewriteCond %{REQUEST_URI} !^/\.well-known/cpanel-dcv/[0-9a-zA-Z_-]+$
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/(?:\Ballot169)?
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]

RewriteCond %{REQUEST_METHOD} =POST
RewriteCond %{HTTP_USER_AGENT} ^.*(opera|mozilla|firefox|msie|safari).*$ [NC]
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /.+/trackback/?\ HTTP/ [NC]
RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/[0-9a-zA-Z_-]+$
RewriteCond %{REQUEST_URI} !^/\.well-known/cpanel-dcv/[0-9a-zA-Z_-]+$
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/(?:\ Ballot169)?
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
RewriteRule .? - [F,NS,L]
3
  • Is there a particular part that is confusing to you? Are you asking about what the .well-known exceptions are for, or are you asking what the purpose of the rule is? May 22, 2019 at 19:41
  • 1
    I am confused about both the purpose of .well-known exceptions and so many conditions. Is this just something temporary put in place by the host or is it best practice to keep it in place? Why are there two sets of conditions and rules. Can they be combined into one set? I really do not know much about .htaccess May 22, 2019 at 20:32

1 Answer 1

3

Why are there two sets of conditions and rules. Can they be combined into one set?

These are two rules that serve two different purposes - they cannot be combined. Taking out the (unnecessary) ".well-known" conditions, we have:

RewriteEngine On
RewriteCond %{SERVER_PORT} 80 
RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]

RewriteCond %{REQUEST_METHOD} =POST
RewriteCond %{HTTP_USER_AGENT} ^.*(opera|mozilla|firefox|msie|safari).*$ [NC]
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /.+/trackback/?\ HTTP/ [NC]
RewriteRule .? - [F,NS,L]

The first is an HTTP to HTTPS redirect. (Which should really be a 301 permanent redirect, not a 302 temporary redirect as it is currently written.)

The second rule would seem to block Trackbacks. This is a "feature" that allows websites/blogs (particularly WordPress) to acknowledge linkbacks to articles and is often shown as a comment. However, this can be abused by spammers, hence the desire to block them.

I am confused about both the purpose of .well-known exceptions and so many conditions. Is this just something temporary put in place by the host or is it best practice to keep it in place?

These conditions play no part in the rules themselves, they are simply creating exceptions so the rules don't run when these requests are made. This occurs when your host auto-renews security certificates.

They are only needed temporarily (if at all). However, they are likely to be required again in a few (3?) months time when the certificates are next renewed.

However, as noted by @Stephen in comments, for these particular rules, the conditions are most probably superfluous anyway. However, cPanel does not discriminate, it blindly adds these conditions before every RewriteRule directive. If you manually remove them then cPanel is likely to add them back when it comes to cert renewal (as mentioned).

See also my answers on the following ServerFault questions for more information regarding these conditions:

8
  • 1
    The .well-known exceptions shouldn't ever be needed on the last rule. If the URL has "trackback" in it, it is unlikely to ever match a ./well-known/ URL. May 23, 2019 at 15:27
  • I'm also not sure why you would need an exception for .well-known/acme-challenge for the HTTPS redirect. LetsEncrypt follows redirects when validating site ownership and will issue certificates even if the site redirects somewhere else. It just needs to have the correct challenge response at the end of the redirect. May 23, 2019 at 15:29
  • @StephenOstermiller True. Unfortunately cPanel appears to blindly add these conditions before every RewriteRule regardless. If you remove them then they are likely to reappear. The 3rd condition that includes "Ballot169" is a bit of a strange one (mentioned in the linked question above) as it basically renders the 4th condition superfluous!?
    – MrWhite
    May 23, 2019 at 16:07
  • Thank you MrWhite for editing my question and illustrating a simplified version of the code. Thank you MrWhite and Stephen Ostermiller for discussing the whys and wherefores. I no longer have WordPress installed on that domain so it would seem that blocking Trackbacks is redundant. The HTTP to HTTPS redirect I believe was put in place to give the impression to visitors that the site is secure when in fact I have no certificate so I believe I should remove that as well. I think my host provides a free certificate but in order to implement it I need to have a dedicated IP, which I do not. May 24, 2019 at 6:31
  • "The HTTP to HTTPS redirect I believe was put in place to give the impression to visitors that the site is secure when in fact I have no certificate" - You can't redirect to HTTPS unless you have a valid certificate. (?) Your users would either get a browser warning telling them that the cert is invalid (at best) or the browser will simply fail to connect (if you have no cert at all).
    – MrWhite
    May 24, 2019 at 9:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.