Apache mod_rewrite non-www to www

...for both http AND https (is this the best strategy?)

[skyeflye]

Hi Everyone,

I posted this earlier over in the private forums, but may not get any response soon in there. If I receive any answers here I'll copy the end result to that other thread as well.

I will be launching a new site with a new domain name that no search engine has ever indexed. Obviously, I wish to start things off as "correctly" as possible in terms of SEO. Among many other strategies I've learned here on WW (thank you), I would like to do the "301 redirect thing" from example.com to www.example.com. I have some experience with mod_rewrite but not specifically dealing with SSL/HTTPS. So, I'm having some have self doubt. :)

I think my main goal here is to 301-redirect ALL "non-www" to "www" for both the HTTP and HTTPS requests.

Question#1
I'm a bit new to SSL in general. I wonder, will redirecting the HTTPS requests in this way with mod_rewrite and the [R=301,QSA,L] flags cause any browser "security" warnings? Most of the HTTPS requests will have GET and/or POST form variables (if that matters).

Question #2
Is there a more "efficient/intelligent" way of accomplishing this than the two, separate mod_rewrite attempts below? I'm not even sure if either of the below mod_rewrite examples will even accomplish this goal at all.

Question #3
Is the "QSA" flag needed at all in this situation?

--begin mod_rewrite test strategy 1--

##mod_rewrite test #1 - NOT TESTED
##The first set of Conditions will skip SSL (port#443) requests
##The second condition test "captures" the remaining SSL requests
RewriteEngine on
RewriteCond %{HTTP_HOST} ^example\.com [NC]
RewriteCond %{SERVER_PORT}!443
RewriteRule ^(.*) http://www.example.com/$1 [R=301,QSA,L]

#rewrite all "remaining" (HTTPS) requests
RewriteCond %{HTTP_HOST} ^example\.com [NC]
RewriteRule ^(.*) [example.com...] [R=301,QSA,L]

--end mod_rewrite test strategy 1--

--begin mod_rewrite test strategy 2--

##mod_rewrite test #2 - NOT TESTED
## This one attempts to use the %{REQUEST_METHOD} environment variable (perhaps improperly & illegaly)
RewriteEngine on
RewriteCond %{HTTP_HOST} ^example\.com [NC]
RewriteRule ^(.*) %{REQUEST_METHOD}www.example.com/$1 [R=301,QSA,L]

--end mod_rewrite test strategy 2--

Any feedback on this (hopefully common yet unable to find via searches) situation is most appreciated. Thanks!

[Umbra]

Regarding Question # 1 (sort of): We have a website which has an SSL certificate for www.domain.com but not domain.com. I noticed that, in our case, rewritemod can be used successfully to redirect from [domain.com...] to [domain.com....] However, IE throws a browser error message BEFORE the redirect can take place... any ideas?

[skyeflye]

I re-asked this question and got a great answer in a separate thread here:

[webmasterworld.com...]

The last Rewrite Rule shown in that thread (in jdMorgan's post in that thread) seems to work well except that it does nothing when there is no file path requested after the domain name.

So currently:
http://example.com/index.html
...gets rewritten to:
http://www.example.com/index.html

...which is great!

However,
http://example.com/
...is not getting rewritten at all so I'm not sure exactly why, but I want to get the answer.

I've been meaning to ask about this to sort of "complete" that other thread and get the final, "definitive" (for us) answer to this issue. I'm going to do that right now in that other thread (linked to above). Thanks for reminding me to do that! :)

[extras]

I wrote this last year.
It may look complicated, but it reduce the number of RewriteRule, and it's generic.

Options +FollowSymlinks
RewriteEngine On
RewriteCond %{HTTP_HOST}//s%{HTTPS} ^[^w][^w][^w][^.].*//((s)onúUs.*) [NC]
RewriteRule ^ http%2://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

You may want to use the code combined with the missing trailing slash fix.

Options +FollowSymlinks
RewriteEngine On
RewriteCond %{REQUEST_URI}\\/%{HTTP_HOST}/www.//s%{HTTPS} ^/+(.+/)?[^.]*[^/]\\(/)([^w][^w][^w][^.].*/(www\.)úU.*)//((s)onúUs.*)$ [OR,NC]
RewriteCond %{HTTP_HOST}/www.//s%{HTTPS} ^(/)?(/)?([^w][^w][^w][^.].*/(www\.))//((s)onúUs.*)$ [NC]
RewriteRule ^ http%6://%4%{HTTP_HOST}%{REQUEST_URI}%2 [L,R=301]

[extras]

I think the code got corrupted when I posted... sorry.
I'll try again disabling [codes], and it means you have to watch out for the effect of word wrapping.

---------------------
Options +FollowSymlinks
RewriteEngine On
RewriteCond %{HTTP_HOST}//s%{HTTPS} ^[^w][^w][^w][^.].*//((s)on¦s.*) [NC]
RewriteRule ^ http%2://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Code with missing trailing slash fix.
----------------------

Options +FollowSymlinks
RewriteEngine On

RewriteCond %{REQUEST_URI}\\/%{HTTP_HOST}/www.//s%{HTTPS} ^/+(.+/)?[^.]*[^/]\\(/)([^w][^w][^w][^.].*/(www\.)¦.*)//((s)on¦s.*)$ [OR,NC]
RewriteCond %{HTTP_HOST}/www.//s%{HTTPS} ^(/)?(/)?([^w][^w][^w][^.].*/(www\.))//((s)on¦s.*)$ [NC]
RewriteRule ^ http%6://%4%{HTTP_HOST}%{REQUEST_URI}%2 [L,R=301]

[1][[b]edited by[/b]: extras at 5:32 pm (utc) on Jan. 21, 2006][/1]

[extras]

hmmm... I thought I disabled [ codes ] and smilies,
and verified with preview, but still getting the code transformed.

Please replace all 'u' with accent followed by 'U' with a vertical bar ¦ .

If you have a problem, e-mail me. WebmasterWorld AT check-these.info

EDIT:

I think I shouldn't have previewed the post before submitting.
I used Edit link, and submitted without previewing.
Now the vertival bars ¦ stay there.

[skyeflye]

Hey extras!

Thanks very much for you help. And thanks for your effort in trying to get the code to display correctly in this forum. Your patterns are amazing...very creative! It has taken me over an hour just to figure out how to "read" the syntax. I learned a lot!

Quick Question:

Do you know if implementing these patterns for rewriting the HTTPS requests protocol requests will cause any warnings in the browser when (for example) the request is forwarded from https://domain.com/(.*) to https://www.domain.com/(.*)

I am just concerned that the browser will popup some dumb warning message to the user that their request is being redirected. But perhaps it doesn't do this when it is being redirected to the "www." subdomain or because the redirect is still remaining under the secure HTTPS protocol.

Thanks again!

[extras]

Normally, you do something like this.
(Forcing www, both https and http, with the trailing slash fix)

Options +FollowSymlinks
RewriteEngine On
# trailing slash fix for https
RewriteCond %{HTTPS} on [NC]
RewriteRule ^/*(.+/)?([^.]*[^/])$ https://%{HTTP_HOST}/$1$2/ [L,R=301]
# trailing slash fix for http
RewriteRule ^/*(.+/)?([^.]*[^/])$ http://%{HTTP_HOST}/$1$2/ [L,R=301]
# Force www for https
RewriteCond %{HTTPS} on [NC]
RewriteCond %{HTTP_HOST}!^www\. [NC]
ReriteRule ^(.*)$ https://www.%{HTTP_HOST}/$1 [L,R=301]
# Force www for http
RewriteCond %{HTTP_HOST}!^www\. [NC]
ReriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [L,R=301]

It's 4 RewriteRules with additional 4 RewriteConds.
And it looks repetetive.
So, I squeezed everything in a single RewriteRule + 2 RewriteCond lines.

As for the browser warning, I don't know.
I've never see it, but it may depends on the browser and the security setting.

Personally, I prefer the domain name without 'www',
as it requires less typing.
Also you don't need the missing trailing slash fix code
when we use domain name without www.

The code for removeing www.

Options +FollowSymlinks
RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^ http://%1%{REQUEST_URI} [L,R=301]
If you want to cover both http and https:
Options +FollowSymlinks
RewriteEngine On
RewriteCond %{HTTP_HOST}//s%{HTTPS} ^www\.(.*)//((s)on¦s.*)$ [NC]
RewriteRule ^ http%3://%1%{REQUEST_URI} [L,R=301]

[skyeflye]

Thanks for the additional info and further explanation! This is all very helpful and educational for me.

I will try to implement this on one of my sites and then test the HTTPS URLs with various browsers and various security settings within each browser. There may also be a difference for how "concerned" the browser becaomes with a URL that has GET or POST querystring variables vs. a URL that has no querystring variables.

It may take me a couple weeks, but I'll post back here with the results.