Where to place 301 redirect code in .htaccess?

Question about 301 redirect in .htaccess file

[Stratcat]

I'm a newbie. I've never messed with the .htaccess file before, so bear with me...

My question is, does it matter where in the .htaccess file you place the 301 redirect code? Is there a proper order that the various .htaccess directives need to be in?

The code I'm going to use is:

RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_HOST} ^example.com$ [NC,OR]
RewriteCond %{HTTP_HOST} ^Example.com$ [NC]
RewriteRule ^(.*)$ http://www.example.com/$1 [R=301,L]

Do I have the code correct and should I place it somewhere at the top of the file, at the bottom, or somewhere in between such as after the <limit></limit> tags and before the AuthName directive?

Everything I've read - from the apache docs to various forums - all just say to add the lines of code. No one ever says where to place it.

I just don't want to break anything or do something stupid. (I have made a backup of my original .htaccess file just in case but I'd still like some expert advice before I just start experimenting.)

Thanks,
Dean

[edited by: jdMorgan at 2:36 pm (utc) on April 21, 2006]
[edit reason] Example.com [/edit]

[jdMorgan]

It actually doesn't matter, as long as you don't have any other mod_rewrite code in your .htaccess file already.

That's because .htaccess is not 'executed' top-to-bottom like a program, but rather scanned in turn by each of the Apache modules loaded on the server. Each module looks at the .htaccess code in turn, and executes only the directives that it understands. The order in which the modules execute is determined by the reverse LoadModule list order on Apache 1.x, and by an internal priority scheme on Apache 2.x.

So, the order of your directives in .htaccess only matters on a per-module basis. As long as you don't have other mod_rewrite code already in there, then there is nothing your rules could interfere with.

I would strongly suggest reviewing the mod_rewrite-related documents cited in our forum charter [webmasterworld.com], and analyzing your code line-by-line using those documents. Of particluar concern is the meaning of the flags, such as [NC]. For example,

RewriteEngine on
RewriteBase /
RewriteCond %{HTTP_HOST} ^example\.com [NC]
RewriteRule (.*) http://www.example.com/$1 [R=301,L]

is entirely sufficient to handle all cases, because [NC] makes the RewriteCond case-insensitive. Therefore, the second RewriteCond was unnecessary. Do not end-anchor host names, unless you account for the fact that they may have a port number appended, such as "www.example.com:80/", and though that is completely valid, it would break a rule which depended on an end-anchored hostname.

Nothing seriously wrong there, but understanding the details of your code may save you an awful lot of time and trouble.

Note that you may have to add

Options +FollowSymLinks

above your "RewriteEngine on" directive, if this option is not already enabled in your server configuration. Without it, mod_rewrite won't run. Don't add it unless you find you need it, though -- no use wasting the server's resources if it's already done.

Jim

[Stratcat]

Thanks Jim,

That clears up a lot of my questions. I'm off to read the forum charter link you suggested. I appreciate the help.

Dean

[Stratcat]

Okay, I've added the redirect code to my .htaccess file and the site didn't crash.

However, I now get an error message popping up randomly from I.E. stating: "An ActiveX control on this page might be unsafe to interact with other parts of the page. Do You want to allow this interaction?"

I'm assuming it is the result of the redirect, because it wasn't happening before.

Any thoughts on why this is happening and how to fix?

The redirect code I went with is:

RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_HOST} ^example\.com [NC]
RewriteRule ^(.*) http://www.example.com/$1 [R=301,L]

Any help would be appreciated. The last thing I need is something scaring people into thinking something on my site might be unsafe.

Thanks,
Dean

[jdMorgan]

IE is probably detecting that the ActiveX control is marked as coming from a different domain than the newly-redirected page itself.

I can't help with ActiveX -- I disabled it in IE years ago, and use non-IE browsers almost exclusively except when testing my own stuff for cross-browser compatibility. Like pop-ups, Active-X does not exist for me anymore.

You may need to load the control from the new domain in order to avoid the warning message, but that is just a guess. You might also want to poke around in the Microsoft knowledge base for articles about Active-X controls and cross-site scripting vulnerabilities.

Jim

[Stratcat]

Thanks Jim,

I think you're correct. The only script on my home page is for Google Analytics (Urchin) and I'll bet that it is trying to load from Google for the incorrect domain. I'll go check to see how I've got it configured.

By the way, I appreciate you pointing me in the right direction concerning flags and anchors. I've been reading up on them and I'm starting to understand better how they're used.

Still have a long way to go, but it's nice to have a forum like this where knowledgeable people like yourself are willing to give of their time to answer questions.

Thanks again,
Dean