.HTACCESS is Creating Unnecessary 301 Redirect Chain - How to Remove?

Question

My Stack:

• LAMP
• Apache/2.4.41

Background Information:

I recently launched a new website for a client. During the re-design process we decided to:

• Switch to sitewide HTTPS
• Remove the .php extension from the URLs
• Switch to a CMS

Example of OLD URL:
http://www.example.com/courses/acme-course.php

Example of NEW URL:
https://www.example.com/courses/acme-course

My Issue:

An unnecessary additional 301 Redirect is occurring when a user navigates to one of the OLD URLs.

I do not understand why the additional 301 redirect is being created and not sending the user directly to the correct destination URL using a single 301 redirect.

Interesting Observation:

The unnecessary additional 301 Redirect does not occur when I use the OLD URL with HTTPS instead of HTTP.

Example:
https://www.example.com/courses/acme-course.php _

Using the above URL will correctly do a single 301 Redirect to the correct destination URL of: https://www.example.com/courses/acme-course

Here's an Example of a 301 Redirect Chain:

Original Request URL:

http://www.example.com/courses/acme-course.php

1ST 301 Redirect (Unnecessary):

FROM:

http://www.example.com/courses/acme-course.php

TO:

https://www.example.com/index.php?url=courses/acme-course.php

2ND 301 Redirect (Correct Final Destination URL):

FROM:

https://www.example.com/index.php?url=courses/acme-course.php

TO:

https://www.example.com/courses/acme-course

My .htaccess code:

# (1) General Settings <IfModule mod_rewrite.c> Options +FollowSymLinks RewriteEngine On </IfModule> # (2) Force WWW <IfModule mod_rewrite.c> RewriteCond %{HTTPS} !=off RewriteCond %{HTTP_HOST} !^www\. [NC] RewriteCond %{SERVER_ADDR} !=127.0.0.1 RewriteCond %{SERVER_ADDR} !=::1 RewriteRule ^ %{ENV:PROTO}://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L] </IfModule> # (3) Force HTTPS <IfModule mod_rewrite.c> RewriteCond %{HTTPS} !=on RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L] </IfModule> # (4) URL Routing for CMS <IfModule mod_rewrite.c> RewriteCond %{HTTPS} =on RewriteRule ^ - [env=proto:https] RewriteCond %{HTTPS} !=on RewriteRule ^ - [env=proto:http] ## Check if file/directory exists RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d ## Route all other URLs to index.php/URL RewriteRule ^(.*)$ index.php?url=$1 [PT,L,QSA] </IfModule> 

Answer 1

You have two main issues....

1. Your directives are in the wrong order in the .htaccess file. Your HTTP to HTTPS and www canonical redirects need to go before your front-controller that routes the URL to your CMS. Hence the incorrect external redirect to /index.php?url=courses/acme-course.php - exposing your internal CMS URL structure.

2. The removal of .php is not actually being performed by your .htaccess directives?! I assume this must be being done by your application/CMS logic? Consequently, this will always result in a second redirect (since .htaccess is redirecting to HTTPS on the same URL-path). You need to do something like the following at the top of your .htaccess file to remove the .php extension.

   RewriteRule (.+)\.php$ https://www.example.com/$1 [R=301,L] 

UPDATE: If I reorder the rules/conditions, does my placement of Options +FollowSymlinks stay the same?

It doesn't really matter where the Options directive occurs. However, it is logical (from a readability standpoint) to have it near the top. (Apache directives don't necessarily execute in the order they appear in the config file, as each module works independently.)

Assuming you are hand-coding your .htaccess file then it can be tidied up...

1. There is no need for the (multiple) <IfModule mod_rewrite.c> wrappers. Is mod_rewrite optional? Is your site be ported to multiple servers where mod_rewrite is not enabled?

2. There is no need for multiple RewriteEngine directives. The last instance actually wins and controls the entire file.

   Multiple <IfModule> blocks and RewriteEngine are typical of systems that are automatically edited by code and/or designed to function unedited on multiple servers.

So, your .htaccess file should be rewritten like this in this order:

Options +FollowSymlinks # Enable the rewrite engine... RewriteEngine On # ---------------------------------------------------------------------- # | Forcing `https://` | # ---------------------------------------------------------------------- # Redirect to HTTPS on the "same host" (requirement for HSTS) RewriteCond %{HTTPS} !=on RewriteRule (.*) https://%{HTTP_HOST}/$1 [R=301,L] # ---------------------------------------------------------------------- # | Forcing `www` | # ---------------------------------------------------------------------- RewriteCond %{HTTP_HOST} !^www\. RewriteCond %{SERVER_ADDR} !=127.0.0.1 RewriteCond %{SERVER_ADDR} !=::1 RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L] # ---------------------------------------------------------------------- # | URL Routing for CMS | # ---------------------------------------------------------------------- # (3) RewriteCond %{HTTPS} =on RewriteRule ^ - [env=proto:https] RewriteCond %{HTTPS} !=on RewriteRule ^ - [env=proto:http] # (4) - Check if physical file exists RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d # (5) - Rewrite all other URLs to index.php/URL RewriteRule (.*) index.php?url=$1 [L,QSA] 

Additional Notes:

• The PROTO environment variable contains whatever protocol is being requested. With the order of the redirects this is now always going to be HTTPS. The reason for this variable at all is so the CMS can redirect to HTTP if HTTP is accessed, or HTTPS if HTTPS is accessed. If you are forcing HTTPS then it doesn't really apply. (Although this env var may still be used by your application.)

• Rarely should you use the NC flag on a negated condition. Hence why I removed it from the condition !^www\.. You want it to redirect when the host does not start with www. - all lowercase. With the NC flag it will fail to redirect WwW. - although this would be very rare anyway.

• I've removed the unnecessary check for HTTPS on the www canonical redirect.

• The PT flag on the last RewriteRule is not required in .htaccess. In .htaccess this is the default behaviour (pass through).

• You will need to clear your browser cache before testing, as the erroneous 301 redirects will likely have been cached by the browser. It is a good idea to test with 302 (temporary) redirects for this reason.