Two htaccess files

looking to prepare for transition to https

[lee_sufc]

I am preparing my site's transition to https.

My site is split into two: first half is free advice articles run on WordPress and the second is eCommerce pages run on standalone html pages (the /cart section is already https but isn't indexed (deliberately)).

Obviously, I have double the work involved to convert everything to https. I also have two htaccess files - one of which is located in the Wordpress directory. Do I need to edit both? Also, how do I go about creating the rules needed so that non www. https pages redirect to

https://www

? My current HT access file for the main site is below

RewriteOptions inherit
RewriteEngine On

RewriteCond %{HTTP_HOST} ^example\.com [NC]
RewriteRule (.*) http://www.example.com/$1 [R=301,L]

#Gzip
<ifmodule mod_deflate.c>
AddOutputFilterByType DEFLATE text/text text/html text/plain text/xml text/css application/x-javascript application/javascript
</ifmodule>
#End Gzip

#cache html and htm files for one day 
<FilesMatch ".(html|htm)$"> 
Header set Cache-Control "max-age=43200" 
</FilesMatch> 

#cache css, javascript and text files for one week 
<FilesMatch ".(js|css|txt)$"> 
Header set Cache-Control "max-age=604800" 
</FilesMatch> 

#cache flash and images for one month 
<FilesMatch ".(flv|swf|ico|gif|jpg|jpeg|png)$"> 
Header set Cache-Control "max-age=2592000" 
</FilesMatch> 

#disable cache for script files 
<FilesMatch "\.(pl|php|cgi|spl|scgi|fcgi)$"> 
Header unset Cache-Control 
</FilesMatch> 

#Redirect old affiliate pages
RewriteEngine on
RewriteBase /
RewriteRule ^aff/(.*) /page.htm [R=301,L]
RewriteEngine on
RewriteBase /
RewriteRule ^idevaffiliate/(.*) /newpage.htm [R=301,L]

RewriteCond %{HTTP_HOST} ^example\.com$ [OR]
RewriteCond %{HTTP_HOST} ^www\.example\.com$
RewriteRule ^oldpage\.htm$ "http\:\/\/www\.example\.com\/newpage\.htm" [R=301,L]

RewriteCond %{HTTP_HOST} ^example\.com$ [OR]
RewriteCond %{HTTP_HOST} ^www\.example\.com$
RewriteRule ^JobSeekerTools\.htm$ "http\:\/\/www\.example\.com\/blog\/" [R=301,L]

Redirect 301 /page.htm http://www.example.com/page/
Redirect 301 /blog/page2/ http://www.example.com/blog/pagenew

RewriteRule ^blog/index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule blog/ /blog/index.php [L] 

I've got to be honest - this whole thing is stressing me out! Trying to find someone online to help me seems impossible (nobody seems to want me to pay them to help me so I'll take the risk and go it alone, lol).

[edited by: not2easy at 8:41 pm (utc) on Nov 25, 2016]
[edit reason] readability [/edit]

[ergophobe]

.htaccess rules cascade. It's the reason it has some efficiency issues (minor) - if you request a file seven levels down in the directory tree, every directory up to web root has to be checked for applicable rules.

So if you have your http to https redirect in the top level, that will apply all the way down unless there's a conflicting rule.

If you aren't pulling third-party resources in, it should be pretty simple. If you *are* pulling in third-party resources, make sure they are https too

[lucy24]

Is the entire site changing to https? If so, it will be extremely easy. Any place where you currently have a domain-name-canonicalization redirect (fancy name for the "with/without www" rule), simply add a second RewriteCond that says, for example,
%{HTTPS} off
(There are a couple of alternatives, such as REMOTE_PORT and something about PROTOCOL but-don't-quote-me. But they all should end up in the same place.) Separate the two conditions with [OR].

If you're interested in shaving picoseconds, put the HTTPS condition first, because it will probably succeed more often than the wrong-www condition. At least in the first year or so while external links are getting updated and search engines are learning the ropes.

if you have your http to https redirect in the top level, that will apply all the way down unless there's a conflicting rule.

Remember, these are RewriteRules, which generally don't cascade downward. (Rare exceptions in 2.4 if you've set some inheritance options to non-default values.)

[ergophobe]

RewriteRules, which generally don't cascade downward

I didn't realize that rewrites are special in that respect. Not sure I ever heard that.

[not2easy]

It is true, I found out the hard way - years ago - that the www canonical 301 in the root htaccess was not having any effect on directories that had their own htaccess files. Blocked CIDRs and UAs were inherited, but not the www rewrite.

[lucy24]

[httpd.apache.org...]
Currently that gets you the 2.4 version, which has more bells and whistles than 2.2, though the defaults haven't changed. In 2.2, only the bare "Inherit" was available.

I did a text search and was bemused to find that the string "inherit" occurs 21 times on the page.

Note that rewrite configurations are not inherited by virtual hosts. This means that you need to have a RewriteEngine on directive for each virtual host in which you wish to use rewrite rules.

(It also means that if you have RewriteRules inside a <Files> envelope--which you are not supposed to do, only no one told me--you have to say RewriteEngine on all over again.)

[phranque]

Do I need to edit both?

are you doing any external redirects in the .htaccess for the cart section?
if you can access this section with http: or non-www then you need to solve this problem without unnecessary external redirects or exposing internal urls in a subsequent redirect

RewriteRule ^oldpage\.htm$ "http\:\/\/www\.example\.com\/newpage\.htm" [R=301,L]

does this even work?
the substitution string should be plain text, so no need for quotes or backslashes.

Redirect 301 /page.htm http://www.example.com/page/

you don't want to mix these mod_alias and mod_rewrite directives here.
you should convert your Redirect directives to RewriteRule directives.

the reason is described here...
https://www.webmasterworld.com/apache/3403983.htm?highlight=msg3404382#msg3404382

you cannot control the order in which different module's directives execute by specifying their order in .htaccess -- The module execution order determines that.

[phranque]

.htaccess rules cascade.

not sure what you mean by this.
if you use the RewriteOption directive you can have an inheritance of rules from parent contexts.
without this, the .htaccess file in a subdirectory won't fire the rules from the root directory.

perhaps this is a useful reference...
Apache mod_rewrite Technical Details - API Phases & Ruleset Processing:
https://httpd.apache.org/docs/current/rewrite/tech.html [httpd.apache.org]

[phranque]

Note that rewrite configurations are not inherited by virtual hosts.

this applies to the RewriteEngine directive.
virtual hosts are specified in the server config context and we're talking about .htaccess here, where the RewriteEngine on is supplied.

[ergophobe]

not sure what you mean by this

Bad choice of words and, as it turns out, flat out wrong for RewriteRules, which I didn't know until lucy24 pointed it out.

I meant that if AllowOverrides is On, then Apache checks every directory in the tree for any directives that apply. So "bubbles up" or "recurses up the tree" would have been more accurate. But in this case, not very accurate. I always try to consolidate all my RewriteRules in one place, so I guess I've never tried having rules apply from a parent and a child at the same time.

[lucy24]

having rules apply from a parent and a child at the same time.

Well, it's never really "at the same time". Even with the range of new inheritance options in 2.4 (including, mercifully, one that translates as "inherit here and continue inheriting so I don't have to keep saying it every time"), your choices are "Before" and "After" (the default).

I though about it and realized that in most situations, "After" really is what you would want, even though it sounds backward. In particular, it means that if and only if no rules in a deeper directory apply to the request, then you go back to the rules in the outer directory--including basics like index redirects and domain-name canonicalization. You wouldn't want those to happen earlier, or you could end up with chained redirects.

[phranque]

beware of the per-directory prefix stripping implications for inherited RewriteRules with patterns attempting to match subdirectories - which may now be the current or a parent directory.

[lucy24]

beware of the per-directory prefix stripping implications

Oh, very interesting point.

:: detour to pore over docs ::

The inherited rules are virtually copied to the section where this directive is being used.

:: further detour to test site to confirm that "virtually copied" means just that--copied--with no supplementary cleverness involving added or removed path elements ::

If your outer htaccess has RewriteRules involving
dirname/blahblah
and you've got an additional htaccess with further RewriteRules located in
dirname/
then--regardless of exact inheritance settings (Up, Down, Before, After)--any rules inherited from that outer htaccess will not work as intended in the inner htaccess.

(a) rules that specify /dirname/ will not be applied at all, because /dirname/ has already been stripped away.

(b) rules that don't specify /dirname/ but do involve a capture of some kind may result in an incorrect redirect.

In particular this means I was horribly wrong when I said earlier that domain-name canonicalization would still work as intended, since it comes after any other redirects. It wouldn't. If you request
www.example.com/dirname/blahblah (assuming a without-www site)
you will be redirected to
example.com/blahblah
instead of the desired
example.com/dirname/blahblah

And that's why "RewriteOptions Inherit" in 99 cases out of 100 will create more problems than it solves. Whew.

All experimenting is based on Apache 2.2. But I don't see any indication that 2.4 would behave differently.

[ergophobe]

Well, it's never really "at the same time".

By which I mean "on the same site." I have always tried to keep all my RewriteRules in the same spot (so, if using .htaccess for said purpose, in the web root). The only time I use .htaccess elsewhere is for access rules.

[lucy24]

The only time I use .htaccess elsewhere is for access rules.

Yup. I've also got a couple of spots--mainly image directories--where I enable auto-indexing. And one directory has its own 404/410 page. The only reason we need to do any of those is because <Directory> sections can't be nested, darn it, which in turn means that an htaccess file can't contain <Directory> sections, double darn it.