301/307 IP Exception

Non-finished WP in root - actual site in subdirectory

[andreglud]

Hi there! Note, I'm not a server guy. I have never touched a htaccess file before. Please have patience.

Our new Wordpress site is located in root and old site files are placed in a subdirectory where a 307 directs to it. The old site caused a lot of problems being side-by-side with the new WP site, so it had to be moved. With 307, I'm not able to edit or view any of the wordpress files because of the redirection. I'm trying to make an exception but everything I've tried either breaks the site or does nothing.

RewriteCond %{REMOTE_ADDR} !^11\.222\.33\.444

Only gives a 500 server error.

Changing DNS to redirect to the old site in subdirectory, made the whole site non-responsive. (Chrometab crashes after loading for 3 min)

This is how it looks now:

Redirect 307 /index.php http://example.dk/backupall/index.htm
RewriteEngine On
RewriteCond %{REMOTE_ADDR} !^11\.222\.33\.444
RewriteCond %{REQUEST_URI} /reset-pageviews [NC]
RewriteRule .* index.php [F,L]

but it basically does nothing. I'm still being redirected. Also after clearing cookies and dns.

TLDR; How do I make a 301/307 while still being able to access/workaround the redirection?
I would appreciate a pedagogical response. ;)

[edited by: phranque at 1:11 am (utc) on Feb 19, 2019]
[edit reason] anonimize IP [/edit]

[TorontoBoy]

I don't know the answer to your question, but it would be safer to put both the old and new WP versions in their own subdirectory and have no site in root. Bots will surely attack your root, as this is the most common place for a WP install. Bots need to find the subdir name before they can successfully attack. Having multiple WP installs, all in subdirs has no problems.

[andreglud]

Thanks for your tip! I will probably do that in the near future, but for now I'm too afraid to break WP again. I JUST got it working after migrating from another server ;)

[TorontoBoy]

With each WP install in its own subdir you can use the root htaccess to redirect the request to the required WP install. When there is a WP in the root that WP has its own WP htaccess that is required.

With each WP in its own subdir you can protect all subdirs with a single htaccess in root, using the inheritance property of SetEnvif

[not2easy]

WordPress is best managed within itself and can be viewed as your domain's homepage as if it were in the root directory even though it lives in its own folder. Check the location settings under Settings > General ... WordPress Address URL: and Site Address URL: to tell WP where it is supposed to be.

You currently have at least three efforts which might affect one another: WP Settings, mod_rewrite and mod_alias in the same htaccess.

There is disagreement about combining mod_rewrite and mod_alias because it has been problematic in some cases. The "Redirect 307" uses Apache's mod_alias module and the "RewriteRule" uses mod_rewrite. This can depend on the version of Apache and/or the server's configuration file so when/if there are things that do not work as expected it is the prime suspect and just better to turn the redirect into a rewrite to eliminate a known possibility. Also important to know that you are relying only on one htaccess file in the root directory.

[lucy24]

:: detour to look up [w3.org] what the heck is a 307 ::

How did you decide that this is the appropriate response, instead of the ordinary 302 for temporary redirects? And, for that matter, why is it temporary at all? It doesn’t seem the optimal solution for what appears to be a permanent condition.

RewriteCond %{REMOTE_ADDR} !^11\.222\.33\.444

Only gives a 500 server error.

How can you tell? Unless this is the very last mod_rewrite-related utterance in your htaccess, this RewriteCond will be read as belonging to the next RewriteRule, no matter how far away it is. What rule does it belong to?

Ordinarily, mod_alias executes after mod_rewrite. In a CMS such as WordPress, this effectively means that redirects involving mod_alias will never execute, because the server has already acted on the !-f conditions that form the heart of the CMS.

[phranque]

welcome to WebmasterWorld [webmasterworld.com], andreglud!

what url pattern are you using for the old site vs the WP site?

RewriteCond %{REMOTE_ADDR} !^11\.222\.33\.444
RewriteCond %{REQUEST_URI} /reset-pageviews [NC]
RewriteRule .* index.php [F,L]

if you are intending to block this request unless coming from the specified IP, i would suggest:

RewriteCond %{REMOTE_ADDR} !^11\.222\.33\.444$
RewriteRule ^reset-pageviews$ - [F]

- when using [F], an [L] is implied
- the URI isn't modified for 403 responses, so the target uses the "-" syntax
- it is more efficient to specify the path in the RewriteRule pattern than to wait for the RewriteCond to fire on every request
- you should specify the end anchor for the IP address pattern

[andreglud]

I really appreciate all your answers. Most of them was too much of a mouthful for me to understand but I'll try and give the best answer as possible.

The code already in my htaccess is based of snippets of what I've found on the subject around the web. I wish I could understand more of it, but most is just based on my guesses.

I simply choose 307 because it seemed correct since it was only while finishing up the new WP.

I would really appreciate if you tried to write down what I should try since it's only temporary and I have never touched this subject before.

To sum up:
Old site is in example.dk/backupall/index.htm and should be the one people land on when trying to access through the main domain.
New site is in root. It's a wordpress site as said.
I need everyone but myself to get redirected to the old site, while I'm still able to edit the wp site in root.

Old url pattern is (if I understand correctly) is mostly static. What I mean is that the old site is made of blocks. (It's around 20 years old and super optimized for IE5) ;) In otherwords, the url in the browser doesn't change as the hotlinks on the site links to other blocks thats shown in the window on the page.

It's a public website. example.dk. You're welcome to have a look.

I highly appreciate your answers yet it's hard for me to understand or use it for anything constructive. I wish I could give a better response.

[edited by: phranque at 1:39 pm (utc) on Feb 19, 2019]
[edit reason] exemplified domain [/edit]

[not2easy]

It sounds like you are talking about the olde-time "frames" where various pages are shown via a window on a static page. The ones that used to brag about Netscape Navigator... It might be time to think about updating your template, but that is a different discussion.

We don't do site reviews here in the public forums, that's why in order to help we are trying to determine the site's structure. It would be a mistake to hand off some code to paste into your htaccess file without fully understanding what it is you need to do and what is in that htaccess file that may need replacing or revising.

From your description, you want visitors to "example.dk" to see only "example.dk/backupall/index.htm" which is a single, static page in a subdirectory named "/backupall/". In other words, all traffic to your domain should land on that one page. Is this correct?

You do not want anyone to be able to visit the WordPress version except yourself, so that you can edit from "example.dk", correct?

[andreglud]

That is correct. But! Since it is WP and since I'm using a visual editor, when I try to open a page in the wp editor, it cant loading because it gets redirected. That's why I somehow need an exception in the redirection when the request comes from me.

[lucy24]

That's why I somehow need an exception in the redirection when the request comes from me.

You need to get rid of the mod_alias redirect cited in your first post--the one that begins “Redirect 307”--and change it to mod_rewrite syntax. Only mod_rewrite can recognize the RewriteCond that is an essential part of the rule.

So instead of

Redirect 307 /index.php http://example.dk/backupall/index.htm

you'll need something like

RewriteCond %{REMOTE_ADDR} !^11\.222\.33\.444$
RewriteRule .? http://example.dk/backupall/index.htm [R=307,L]

Functionally there is no difference between .? and .* in the pattern. It just saves the server a picosecond because it doesn't have to gobble up the whole request. Some people like to use the anchor ^ by itself instead. In any case, this bit simply means “there was a request”. The closing anchor in the Condition is only essential if the last piece of your own IP has only 1 or--maybe--2 digits. Otherwise it doesn’t matter.

That's assuming not2easy was right that all external requests are to be redirected. (All of them? Really? Doesn't this static html page have stylesheets and images and so on?) Otherwise, the pattern needs to say ^index\.php instead.

[phranque]

when I try to open a page in the wp editor, it cant loading because it gets redirected

is this the 307 redirect?

That's why I somehow need an exception in the redirection when the request comes from me.

if you need an exception to the (307) redirect, that means you need to use a mod_rewrite directives (RewriteRule instead of Redirect, preceded by a RewriteCond)

http://example.dk/backupall/index.htm

is this url the entire (old) site or is this just the index directory document for the old site?
typically the canonical url would be http://example.dk/backupall/ and you would use the mod_dir DirectoryIndex directive to serve index.htm as the default directory index document:
https://httpd.apache.org/docs/current/mod/mod_dir.html#directoryindex
you would also use mod_rewrite directives to 301 redirect requests for the directory index document to eh trailig slash url (i.e. http://example.dk/backupall/index.htm would redirect to http://example.dk/backupall/ and on the subsequent request mod_dir would quietly serve /backup/index.htm)

[not2easy]

The problem here is that WordPress is installed in the root directory and until it has been built out, andreglud would like to send all visitors for http://example.dk/ to the old frame-built version at http://example.dk/backupall/index.htm. The rewrite to send all visitors to the old page is fairly easy, but because of that rewrite, andreglud is then unable to edit the WP files to do any editing. This is because when WP is installed it is set up to be seen at a particular URL and everyone visiting that URL is sent to the /backupall/ directory.

The ideal method to make this change would be to leave the old site where it was, in the root directory and install WP in a different directory while it is being worked on. If only that one IP is allowed to access the WP folder, then the editing could move ahead. When it is complete, it is simple to make that WP install appear to be in the root directory.

What is needed for the way this is set up is a way to rewrite all root traffic except one IP to a subfolder and then access files in the root directory from that one IP address. I am not at all sure that wordpress would co-operate with that environment because it uses the settings to tell it how/where it is and those settings cover 3 additional directories and the database. The WP boilerplate snippet tells WP to ignore the rewrite and WP won't function without that snippet. Possibly for this situation that snippet might belong above (before) the rewrite rule for all traffic except one IP. (?)

The "index.php" part is because that is the file that corresponds to the WP settings. The /backupall/index.htm is the static frame page for the rest of the site.

The WordPress Codex pages explain about various ways [codex.wordpress.org] to build your WP site, either installing it in its own directory or building it on your computer with one of the free tools for that purpose. This would have been easier but is not the current environment.

[TorontoBoy]

I agree with @not2easy. WP in root is getting confused and wants to take over the site, you redirect some of the requests, it cannot find some files, nothing works.

Here are some options:

1. As @not2easy recommends, move the new wp site to a subdirectory, move the original site back to root, change the redirect in the root htaccess. This should work. You could work on both sites.
   
2. Move the WP install to a subdirectory, leave the old site in its subdirectory. Now no site is in root. Use the htaccess in root to redirect traffic as you wish. This does work. You could work on both sites.
   

Please post your current complete WP htaccess in root. WP changes the URL in many ways using the htaccess, in order to do the various WP stuff it needs to render well. There is a standard WP htaccess that is recommended to use that comes with all WP installs. You should try not to change this htaccess if you do not know its implications. If you are also changing the URL for your purposes then WP will become very confused.

Here is the standard WP htaccess [codex.wordpress.org...] :

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

[andreglud]

Thank you so much to everyone coming with their ideas for a solution. I have read everything through carefully.

I will try and move WP to a subdirectory and keep the current site in /backupall. As said, that should also improve security against attacks.

Again, thank you so much!

[not2easy]

Things to remember about moving WP from one place to another is that WP operates on its "settings" so you may need to change those settings when you move it; If not done in the proper order you may find yourself temporarily unable to login to your WP to edit. The WP Codex pages are there to give you full instructions before you begin so the move can go smoothly for you.