Veify code: RewriteRule ./ /index.php [L]

use of rewrite with wordpress and password protection of directories

[ward00]

I have a WP installation within which I want to password protect a directory - unfortunately using the code example(as suggested by some on this site) RewriteCond $1 !^(cgi-bin|excludedDir2|file\.html) does not stop the 403 errors I get when trying to access the directory externally.

I have found a suggestion to change:
RewriteRule . /index.php [L]
within the WP rewrite rules to the following:

RewriteRule ./ /index.php [L]

Using this code eliminated my 403 errors, but I can't find any confimration on the web that making the change will not cause other problems (seen or unseen)

Can someone verify what the code change actually does, and if they see any problem with using it. Thanks

[lucy24]

The single dot
.
means "absolutely anything, including the entrance page if someone asks for it by name (index.html or similar)". The one and only thing it can not mean is a bare "www.example.com". But if you are on shared hosting, the /index.html may already have been appended before the request ever reaches your .htaccess. If so, the dot really does mean "absolutely any request whatsover".

The dot-slash sequence
./
means "anything within a subdirectory". In fact the leading dot isn't necessary, because there will always be something in front of the first directory slash. Unless you're getting a lot of requests for malformed URLs in the form "www.example.com//blahblah". In that situation, the first slash is disregarded, while the second slash is the beginning of the request.

In your RewriteCond, what does $1 refer to? I don't see anything getting captured in the Rule. This, in turn, means that the Condition will always be met, because

null != something

This is where you need to step back and explain in English what you want to do. Using example.com to prevent auto-linking, and then show your current RewriteRule with its associated Conditions.

[ward00]

My original attempts at trying to password protect a directory within a wordpress installation tried to use the information provided at

[webmasterworld.com...]

an example within the thread above suggested the use of the example code:
RewriteCond $1 !^(cgi-bin|excludedDir2|file\.html)

I included the code in my original post as an example.

the name of the folder within my wordpress folder is called "classes". All the files I am trying to password protect are within the folder, inculding the file index.htm

So my modification to the code above I tried to use and that did not work (it gave page not found errors when I tried to access the folder) was RewriteCond $1 !^(classes|index\.htm)

As indicated in my first post, because the above changes did not work, I found a suggestion to make the change: RewriteRule ./ /index.php [L], which got rid of the page not found error and allowd me to password protect the directory.

With my original question, I wanted to know if by making this change I would cause problems with my Wordpress installation.

[lucy24]

Ah ha! Here is the whole Rewrite in question, minus the detailed # commentary:

RewriteCond $1 ^(index\.php)?$ [OR]
RewriteCond $1 \.(gif|jpg|ico|css|js)$ [NC,OR]
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^(.*)$ - [S=1]

RewriteRule . /index.php [L]

Demonstrating once again how crucially important it is to leave a blank line after each Rule. The /index.php part is an entirely separate rule, with no conditions.

The [S] flag should only be used by people who are absolutely sure what they are doing. That applies to jdMorgan, who created this forum. It does not apply to you and me ;) Details are here [httpd.apache.org] (the Forums will eat the fragment; it's S|skip). Here it means "skip the next rule" -- but then continue in mod_rewrite, looking at any following Rules.

The $1 in the Conditions refers to the capture, which happens to be the entire request, so it could just as well say %{REQUEST_URI}.

The whole package means "If the request meets any of the listed conditions, carry on as if nothing had happened. Otherwise, rewrite to the index.php file".

You can arrive at exactly the same result by turning the whole thing on its head:

RewriteCond %{REQUEST_URI} ^!(index\.php)?$
RewriteCond %{REQUEST_URI} !\.(gif|jpg|ico|css|js)$ [NC]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

That is: IF the request is for anything other than
#1 the index.php file (which may be expressed as "nothing")
#2 a supporting file such as image or css
#3 any file that actually exists
#4 any directory that actually exists
THEN rewrite to index.php.

All of which suggests to me that anyone who speaks fluent Apache could look at an htaccess or config file and instantly tell whether it was written by jdMorgan or g1smd :)