As many know, one can make a friendly URL with mod_rewrite in their .htaccess file like so:

RewriteRule ^category/(.*)$ /somescript.php?category=$1 [L]

This works as long as somescript.php is within the document root folder of the server. If someone was able to guess the actual script (example: if they typed: http://example.com/somescript.php?category=whatever instead of http://example.com/category/whatever), then the chances of duplicate content happening is high because at some point, someone will share the links and it may be possibly indexed in the search engines.

What I am looking for is a way to make somescript.php inaccessible to the public, yet the public should be able to access the friendly URL.

I attempted to use ScriptAliasMatch with the same parameters as RewriteRule except I added a / after the ^ and I removed the [L]. I moved the script to a folder one level up from public_html and I set the user and group name of the folder to the same as the Apache user and group and the permissions of the PHP file is 0x755.

When I attempt to access the file I receive status code 403 forbidden and in the Apache error_log, I receive

client denied by server configuration: /path/to/somescript.php

I also have set loglevel to debug.

Has anyone else been successful in launching scripts at locations inaccessible to the public when the public requests a friendly URL? If so, how did you pull it off?

And I did add the Disallow: /*? line in my robots.txt but I think I need to do more than that as some bots don't respect robots.txt.

  • Check out {DOCUMENT_URI} or {THE_REQUEST} here: httpd.apache.org/docs/current/expr.html#vars
    – closetnoc
    Aug 22, 2015 at 2:57
  • I think I'm using those variables now but I thought if I could do it without trying to match up the script name in rewriterules without having to yet again write another apache module, then I'd go for it. Aug 22, 2015 at 3:01
  • I don't do this stuff as much as I used to- I have to fumble around just like anyone else. @w3d is the guru here!!
    – closetnoc
    Aug 22, 2015 at 3:14

1 Answer 1


You can externally redirect from the "ugly" (for want of a better term) URL to the "friendly" URL. However, you need to be careful of redirect/rewrite loops. One way of avoiding the rewrite loop is to check against THE_REQUEST - this contains the initial request header as sent from the client and is not changed as the rewrite engine rewrites the URL.

This needs to go before your current internal rewrite:

RewriteCond %{THE_REQUEST} \?(category)=([\w-]*)
RewriteRule ^somescript\.php$ /%1/%2? [R=302,L]

[\w-]* - This assumes that the category value can only consists of the characters a-z, A-Z, 0-9, _ and -. It's better to make this as restrictive as possible. However, it also means you should also change the .* pattern in your internal rewrite to match.

Change the R=302 (temporary) to R=301 (permanent) when you are sure it's working OK.

the chances of duplicate content happening is high

Unless the URL structure is being changed or there is some kind of misconfiguration that exposes the "ugly" URL then the chances of "duplicate content" being found and indexed should be low.

A purely "duplicate content" issue could also be resolved (or safe guarded against) by using a rel="canonical" tag - which is probably a good idea anyway.

I attempted to use ScriptAliasMatch ...

Using an Alias won't resolve any duplicate content issues as it doesn't change the URL.

  • If the user types in a friendly URL then it doesn't need changing Aug 22, 2015 at 16:02
  • The above redirect doesn't do anything with the "friendly" URL, that is left for your internal rewrite. The above simply redirects the "real" (or "ugly") URL to the "friendly" URL should the user stumble across it.
    – MrWhite
    Aug 22, 2015 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.