disallow viewing of *.php files, unless the user followed an internal

link

[jake66]

is this possible?

i have tried:
<Files *.php>
Order Deny,Allow
Deny from all
</Files>
in htaccess, but this rendered my entire site inoperable.

i use htaccess to transform .php files to .html; so i don't want users (or search engines) looking at the .php files and thus, producing duplicate content.

[jdMorgan]

Have you considered redirecting all directly-requested .php files to .html?

This has the benefit of preventing duplicate content, while avoiding the reliability problems inherent in access control by referrer.

Jim

[jake66]

i'm not sure how i would go about doing that?

[jdMorgan]

This thread [webmasterworld.com] describes a use of the method I'm thinking of to fix a slightly-different problem.

Jim

[jake66]

thanks for the link

i'm a but confused at what i would have to do, because it's only *.php i want to send over to *.html, i don't have a /blabla.html i need to redirect.

i don't know where to begin with the example of:
# Externally redirect direct browser requests for /topic.html to /topic
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /topic\.html
RewriteRule ^topic\.html$ http://www.example.com/topic [R=301,L]
#
# Internally rewrite requests for /topic to /topic.html
RewriteRule ^topic$ /topic.html [L]

[encyclo]

Is the corresponding .html page always the exact same name as the old .php page? If so, I've used this successfully in the past:

RedirectMatch 301 ^/(.*)\.php$ http://www.example.com/$1.html

[jake66]

i have had bad experiences with 301's. to be quite honest i would rather have anyone accessing a *.php file get a 404 :)

my site is indexed by all major SE's as *.html so i don't think the 404 would do much harm?

but yes, all *.php and *.html pages are exactly the same

[jdMorgan]

If you want a 404, then this should work:

# Rewrite (only) direct browser requests for php files to nonexistent path to generate a 404
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /[^.?]+\.php
RewriteRule \.php /some_page_that_does_not_exist [L]

Beware of interactions with other rules/mechanisms -- you need to be sure that non-existent files are not handled by some other mechanism that would interfere with the above.

An alternative might be:

# Retrun 410-Gone for (only) direct browser requests for php files
RewriteCond %{HTTP_HOST} .
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /[^.?]+\.php
RewriteRule \.php - [G]

Note that this latter example only works for HTTP/1.1 requests, and "extended" HTTP/1.0 requests; Pure HTTP/1.0 does not define or support 410-Gone. Pure HTTP/1.0 user-agents are obsolete and very rare, since they do not support name-based virtual hosts on shared IP addresses.

It's likely that your bad experience with 301s was due to the fact that it's easy to create a loop if the 'special' technique shown here to detect a direct browser request is not used. If you have any search engine listings of php pages that have usable PageRank, then go ahead and redirect them:

# Externally redirect direct browser requests for /topic.html to /topic
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /[^.?]+\.php
RewriteRule ^([^.]+)\.php$ http://www.example.com/$1.html [R=301,L]

Jim

[jake66]

thank you :)

i have added:
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /[^.?]+\.php
RewriteRule ^([^.]+)\.php$ [mysite.com...] [R=301,L]

now, my question is:
does it matter how i have my htaccess arranged?

this rewrites all of my product categories from strings to plain html:
RewriteEngine on
RewriteBase /
RewriteRule ^([^/]*)\.html$ $1.php?%{QUERY_STRING} [NC]
RewriteRule ^/?(product)/([^/]*)\.html$ product_info.php?products_id=$2&%{QUERY_STRING} [NC]
etc, etc.

does it matter where i position your edit? currently, i have it beneath the product_info.php?products_id=$2&%{QUERY_STRING} [NC]

[jdMorgan]

The order of the rules won't matter in this case, since the URLs are mutually-exclusive.

RewriteRule ^([^/]*)\.html$ $1.php?%{QUERY_STRING} [NC]

This rule looks strange in that you are using a negative match on "/" followed by a positive match on "."
The usual approach is that these characters should be the same.
Also, there is no need to handle the query string, as it will pass trough unchanged in the absense of any directions to the contrary.

RewriteRule ^([^.]+)\.html$ $1.php [NC]

Should be functionally equivalent.

The note about the negative match again applies to the rule that follows that one.

Jim