2

I have a website hosted by ionos (formerly 1&1), they have an annoying "feature" (*) whereby an incorrect page request is hijacked and sent to a third party.

The source code for the page I'm redirected to has this script:-

        <script type="text/javascript">
        document.write(
                '<script type="text/javascript" language="JavaScript"'
                        + 'src="//sedoparking.com/frmpark/'
                        + window.location.host + '/'
                        + 'IONOSParkingUK'
                        + '/park.js">'
                + '<\/script>'
        );
    </script>

I was directed to this FAQ which guides me through a custom 404 error page that should prevent this

https://www.ionos.co.uk/help/hosting/html-and-css/create-your-own-error-pages-linux-webhosting

I have set up an .htaccess file like this 

RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule (.*) /error_404.html
ErrorDocument 404 /error_404.html

and the error_404.html has this (with my own site instead of example.com):-

<?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Error 404</title>
</head>
<body>
<h3>This should not have happened. The page you requested does not exist (anymore).</h3>
<p><a href="https://example.com/index.php">Go to the Home page.</a></p>
</body>
</html>

I uploaded both to my website last night but on checking this morning the hijacking is still taking place.

Any ideas what I'm doing wrong? I'm on to IONOS at the moment but wanted thoughts here as well.

(*) I regard this "feature" as a security exposure and reason to move my domain elsewhere and close the account but I need this fixed in the meantime.

Improve this question
1
  • "the page I'm redirected to" - What HTTP status code are you seeing on the redirect? (Is it really an external redirect?)
    – MrWhite
    May 1, 2020 at 9:28

1 Answer 1

Reset to default
2

Make sure you're not seeing a cached response... clear your browser cache, browse with developer tools open and cache disabled (on the Network tab), incognito mode, try a different browser, etc.

That IONOS help article is misleading / dated.

RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule (.*) /error_404.html
ErrorDocument 404 /error_404.html

Hhhmmm, this is a bit silly. You should not need the Rewrite... directives here. Delete this and try simply resetting the 404 error document to default instead:

ErrorDocument 404 default

This should serve the Apache default 404 response. If that works then consider creating a custom error document.

Aside: (Not the cause of the problem...)

<?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

An XML document - seriously? I doubt that you are sending an application/xml mime-type with this response.

You probably want the error response to be plain old text/html...

  • Remove the XML prolog (first line).
  • Change the DOCTYPE to simply <!DOCTYPE html>
  • Remove the xmlns attribute on the html element.
Improve this answer
1
  • 2
    Yeah xml I know, but I was humouring them! This is really embarrassing but I was uploading the .htaccess and 404 file to my Dev website and then checking on Prod, doh! I'm going to accept your answer as the ErrorDocument 404 default also worked.
    – deep64blue
    May 1, 2020 at 9:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.