Skip to main content
Share Your Experience: Take the 2024 Developer Survey
26 votes

Setting X-Forwarded-Proto under Apache 2.4

It's correct to set this directive like RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME} RequestHeader set "X-Forwarded-SSL" expr=%{HTTPS} If it doesn't work, you may need to install and ...
spaceone's user avatar
  • 361
26 votes
Accepted

StartSSL certificate gives SEC_ERROR_REVOKED_CERTIFICATE in Firefox and ERR_CERT_AUTHORITY_INVALID in Chrome

I have some bad news for you. StartSSL's certificates are no longer trusted by Chrome, Firefox, and soon other browsers, beginning with newly issued certificates first. StartSSL won't tell you this of ...
Tom Brossman's user avatar
  • 2,291
24 votes
Accepted

HTTP Status Code: Response with 101 or 301?

The correct status code to use here is without a doubt 301 Moved Permanently. 101 Switching Protocols is an internal status code that a server generally uses to automatically negotiate certain types ...
Maximillian Laumeister's user avatar
18 votes

Allowing access to an Apache virtual host from the local network only

People landing in this answer, please note that this is specific for Apache 2.2. Apache 2.4 has deprecated these directives. The new way is using the module mod_authz_host and the Require directives....
nachoparker's user avatar
12 votes

HTTP Status Code: Response with 101 or 301?

No - 101 Switching Protocols is not appropriate for redirecting to HTTPS, as this status indicates that the current connection should be upgraded to the new protocol, whereas a redirect instructs the ...
HappyDog's user avatar
  • 221
9 votes
Accepted

RewriteRule started returning 403 Forbidden error

For some reason, without me making any changes, those pages have started returning a 403 Forbidden error. It's likely the version of Apache has been updated on your server. I answered a similar ...
MrWhite's user avatar
  • 42.8k
8 votes

StartSSL certificate gives SEC_ERROR_REVOKED_CERTIFICATE in Firefox and ERR_CERT_AUTHORITY_INVALID in Chrome

StartSSL confirmed that this is because of the partially revoked StartCom root certificate. They are working on getting their root certificate fully trusted by browsers again. It sounds like end of ...
Stephen Ostermiller's user avatar
7 votes

AH10411: Rewritten query string contains control characters or spaces

As pointed out by Rohit Gupta in a comment, there was a change to Apache2 outlined in this git pull request, I just had to change my RewriteRules to include the B and BNP flags. For example: ...
Alexis Wilke's user avatar
  • 2,235
6 votes
Accepted

Which is more SEO friendly, redirect or rewrite?

It generally makes little difference. A 301 redirect may cause a short term drop in ranking, but nothing to worry about. An internal rewrite keeps the same URLs. You just need to be careful that you ...
Quentin's user avatar
  • 1,608
5 votes
Accepted

Leverage Browser Caching for third party resources

As @TimFountain says, you have "no control" over resources served from a third party. The request goes to the third party server, not your server - so any code you place on your server is ...
MrWhite's user avatar
  • 42.8k
5 votes
Accepted

SSL Labs Cipher Strength < 100%, why? How do I make it?

The picture basically depicts two things: All ciphers listed in SSLCipherSuite in your Apache2 configuration, which are defined as RSA+*, in my case I had RSA+AESGCM256:RSA+AES256:RSA+AES defined, ...
Vlastimil Burián's user avatar
5 votes
Accepted

500 internal server error when trying to implement reverse proxy under Apache. How do I forward the requests to another server without errors?

Thanks @MrWhite for giving the correct configuration. I needed extra module mod_proxy_http and to change the IP adress of server-B to the hostname as I have multiple vHosts on :80. Here is the ...
wouter205's user avatar
  • 337
5 votes
Accepted

HTTP2 is enabled and working, but PHP $_SERVER['SERVER_PROTOCOL'] still says "HTTP/1.1"

This has to do with how Cloudflare connects to servers. Although it does serve the client via HTTP2 (or HTTP3), it still connects to the server itself via HTTP1.1. Cloudflare only uses HTTP/1.x ...
GreatBlakes's user avatar
4 votes
Accepted

apache virtual hosts on LAN

Your attempting to access the site using a IP address when your virtual host file is setup to use a domain name, not an IP address... so it'll throw up the default folder, in this case /var/www/html/. ...
Simon Hayter's user avatar
4 votes
Accepted

CSP3 Report-To header implementation

There are examples in the draft of the Reporting-Endpoints directive: Reporting-Endpoints = endpoint-1="https://example.com/reports" Your rule is correctly created, as in it returns a valid ...
Braiam's user avatar
  • 210
4 votes
Accepted

Configuring .htaccess to block every request what not image in specified folder and subfolders

I would use mod_rewrite and put this in your main .htaccess near the top, just below RewriteEngine On: RewriteCond %{REQUEST_URI} ^/u/.* RewriteRule !\.(png|jpg|jpeg|gif|svg)$ - [R=404,L] Using a ...
Stephen Ostermiller's user avatar
4 votes

Handling # uri fragments as regular requests

Assuming the file that renders your "one-page" site is index.html and your "pages" are /about, /contact and /help that correspond to elements with ids of the same name (less the ...
MrWhite's user avatar
  • 42.8k
3 votes

Setting X-Forwarded-Proto under Apache 2.4

Those response headers you are seeing look fine. You should not expect to the X-Forwarded-Proto header in them. As you state, that header is set when the request is proxied to the back end. To ...
Stephen Ostermiller's user avatar
3 votes

Restrict mod_pagespeed to specific domains on a server

If you can use .htaccess files you can simply set ModPagespeed off in the httpd.conf and then do this in the root .htaccess for any domain you want it enabled on: <IfModule pagespeed_module> ...
Chris Wheeler's user avatar
3 votes

Verify 2 cookies with mod_rewrite before serving images

but I'm not sure, if the above RewriteCond's act as X and (Y or Z) or (X and Y) or Z In the directives you posted it is the former: X and (Y or Z) However, as mentioned in my comment above, it is ...
MrWhite's user avatar
  • 42.8k
3 votes

Browser cache persistently expires for images in mod_pagespeed cache

I have found that mod_pagespeed serves images and other resources with a cache expiration of 5 minutes if they are not available in its cache directory (yet). Also, after restarting the Apache ...
Helge Klein's user avatar
3 votes
Accepted

What does "Require all granted" on Directory / (root) REALY means? (Apache 2.4 on CentOS7

This is an issue I've ran into a few times & it stems from a change in terminology from Apache 2.2 to Apache 2.4 (detailed here). Access control options that were previously addressed with 'Order ...
Matthew Haeck's user avatar
3 votes
Accepted

.htaccess ErrorDocument directive does not catch 404 errors triggered by PHP http_response_code(404)

Presumably in your htaccess rules you also have a rewrite rule to route all requests to Zend Framework. At this point, Apache (and ErrorDocument) isn't really in the picture, as you've told it you ...
Tim Fountain's user avatar
  • 4,464
3 votes
Accepted

HTTPS - HTTP communication on the same server

The only solution is to use HTTPS for your AJAX service that is running on example.com:port. One easy way to make that happen would be to use a reverse proxy on your main server that is already ...
Stephen Ostermiller's user avatar
3 votes
Accepted

Site works ok on HTTP, not on HTTPS

The problem that you have is because you have not abled AllowOverride All within the SSL virtual host which allows the use of .htaccess which I suspect contains the URL rewrite rules and conditions. ...
Simon Hayter's user avatar
3 votes

Block any other domains from using my server

Your Apache is improperly configured. Apache should only respond to properly configured domains. Somehow, your Apache is configured to respond to any domain, which is your problem. Check your config ...
Machavity's user avatar
  • 203
3 votes
Accepted

Converting nearly 200 redirects into redirectmatches

Since these "old" URLs no longer exist, it is arguably better (ie. more efficient) to perform these redirects late in your application logic, ie. when a 404 would otherwise be triggered, ...
MrWhite's user avatar
  • 42.8k
3 votes
Accepted

htaccess force https not working if there is not an URI

It looks like you might have a conflict with existing directives, however, you can try changing your existing directives to see if it makes a difference: RewriteEngine On RewriteCond %{HTTPS} !on ...
MrWhite's user avatar
  • 42.8k
3 votes
Accepted

Url changing with htaccess

It looks like you are making this more complex than it actually is. Unless you need to be specific about matching "club", it looks like you just need to remove the first path segment when it ...
MrWhite's user avatar
  • 42.8k
3 votes
Accepted

Why does subdomain.localhost work on Ubuntu but not on Debian? (without hosts entry)

Ubuntu is running the service systemd-resolved that maps localhost subdomains to your local IP address. If you query the DNS using dig you will see that it gets the local IP address (127.0.0.1) from a ...
Stephen Ostermiller's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible