Where .htaccess rules apply and when Apache reads them
Because AllowOverride defaults to None, Apache ignores .htaccess files until an administrator enables them. The file name .htaccess is Apache's default value of the AccessFileName directive, which can be changed.
How Apache reads the files
Apache also reads
.htaccessfiles in every parent directory to build the full set of rules for a request.A
.htaccessfile in a deeper directory can override directives set in.htaccessfiles higher up the tree.
To check that the file is read, Apache suggests adding a nonsense word: if no HTTP 500 error appears, AllowOverride None is almost certainly in effect.
The cost per request
Enabling .htaccess slows the server even if no such files exist, because Apache checks for them on every request. Rewrite rules in .htaccess are recompiled on every request, while rules in the main configuration are compiled once and cached.
Redirects, access control and error pages in .htaccess
Typical uses:
Redirects. Google names the
.htaccessfile on Apache as one way to set up server-side redirects. Apache'sRedirectandRedirectMatchdirectives can be used in.htaccesswhenAllowOverrideincludesFileInfo. They send a temporary302unless a status such aspermanentor301is given.HTTPS. Apache says that when only
.htaccessis available,mod_rewriteis the tool for forcing HTTPS. In.htaccess,RewriteRulepatterns and substitutions are written without the leading slash, a common source of errors.Headers. The
X-Robots-Tagheader is added in web server configuration; on Apache that means.htaccessorhttpd.conf.Password protection. Apache's Basic authentication example uses the
AuthType Basic,AuthName,AuthUserFile(thehtpasswdpassword file) andRequiredirectives. Apache says they can go inhttpd.confor.htaccess, if the server'sAllowOverridesetting permits them.Error pages. Custom error pages are set with the
ErrorDocumentdirective, which can be used in.htaccesswhenAllowOverrideis set toFileInfo. IfErrorDocumentpoints to a full remote URL, Apache sends a redirect instead of the error status, which Apache says can confuse robots that check the status code.
Where you have access to the main server file, Apache recommends putting configuration there instead.
These rules are Apache syntax. A move to Nginx, Vercel or another non-Apache platform means writing them again. For SEO on a Next.js target, see Next.js SEO.
For rewriting redirects after a move off Apache, see the headless CMS SEO migration guide.
Where redirects live after Pagepro moves a site off Apache
Nexity, Pagepro's Next.js and Sanity starter, has a Redirect document type built for migrations. Old-to-new URL pairs are managed in Sanity Studio, not in a server file.
Sources
- Apache HTTP Server Tutorial: .htaccess filesApache Software Foundation · httpd.apache.org
- Apache Core Features (ErrorDocument directive)Apache Software Foundation · httpd.apache.org
- Redirects and Google SearchGoogle · developers.google.com
- Apache Module mod_aliasApache Software Foundation · httpd.apache.org
- Redirecting and Remapping with mod_rewriteApache Software Foundation · httpd.apache.org
- Per-directory RewritesApache Software Foundation · httpd.apache.org
- Robots meta tag, data-nosnippet, and X-Robots-Tag specificationsGoogle · developers.google.com
- Apache HTTP Server: Authentication and AuthorizationApache Software Foundation · httpd.apache.org
- Apache HTTP Server: Custom Error ResponsesApache Software Foundation · httpd.apache.org