Apache Tutorial: .htaccess files

+Apache > HTTP Server > Documentation > Version 2.4 > How-To / Tutorials

Apache HTTP Server Tutorial: .htaccess files

Available Languages: en | fr | @@ -36,14 +39,14 @@ changes on a per-directory basis.

Server Side Includes example

CGI example

Troubleshooting

Comments

.htaccess files

Related Modules	Related Directives
`core` `mod_authn_file` `mod_authz_groupfile` `mod_cgi` `mod_include` `mod_mime`	`AccessFileName` `AllowOverride` `Options` `AddHandler` `SetHandler` `AuthType` `AuthName` `AuthUserFile` `AuthGroupFile` `Require`

Related Modules	Related Directives
`core` `mod_authn_file` `mod_authz_groupfile` `mod_cgi` `mod_include` `mod_mime`	`AccessFileName` `AllowOverride` `Options` `AddHandler` `SetHandler` `AuthType` `AuthName` `AuthUserFile` `AuthGroupFile` `Require`

- +

You should avoid using .htaccess files completely if you have access to - httpd main server config file. Using .htaccess files slows down your Apache server. + httpd main server config file. Using .htaccess files slows down your Apache http server. Any directive that you can include in a .htaccess file is better set in a Directory block, as it will have the same effect with better performance.

@@ -62,9 +65,8 @@ changes on a per-directory basis.

if you would rather call the file .config then you can put the following in your server configuration file:

- AccessFileName .config -

AccessFileName .config

In general, .htaccess files use the same syntax as @@ -108,7 +110,7 @@ changes on a per-directory basis.

you don't have access to the main server configuration file. There is, for example, a common misconception that user authentication should always be done in .htaccess files, and, in more recent years, - another miscomception that mod_rewrite directives + another misconception that mod_rewrite directives must go in .htaccess files. This is simply not the case. You can put user authentication configurations in the main server configuration, and this is, in fact, the preferred way to do @@ -135,18 +137,18 @@ changes on a per-directory basis.

.htaccess files.

The first of these is performance. When AllowOverride - is set to allow the use of .htaccess files, Apache will + is set to allow the use of .htaccess files, httpd will look in every directory for .htaccess files. Thus, permitting .htaccess files causes a performance hit, whether or not you actually even use them! Also, the .htaccess file is loaded every time a document is requested.

Further note that Apache must look for .htaccess files +

Further note that httpd must look for .htaccess files in all higher-level directories, in order to have a full complement of directives that it must apply. (See section on how directives are applied.) Thus, if a file is requested out of a - directory /www/htdocs/example, Apache must look for the + directory /www/htdocs/example, httpd must look for the following files:

@@ -191,31 +193,28 @@ changes on a per-directory basis.


     .htaccess file in /www/htdocs/example:
 
     Contents of .htaccess file in
-    /www/htdocs/example

-        AddType text/example .exm
-    
+    /www/htdocs/exampleAddType text/example .exm
+


 
     Section from your httpd.conf
-    file

-      <Directory /www/htdocs/example>

-      
-        AddType text/example .exm

-      
-      </Directory>
-    
+    file+<Directory /www/htdocs/example>
+    AddType text/example .exm
+</Directory>
+    
+


 
     However, putting this configuration in your server configuration
     file will result in less of a performance hit, as the configuration is
-    loaded once when Apache starts, rather than every time a file is
+    loaded once when httpd starts, rather than every time a file is
     requested.
 
     The use of .htaccess files can be disabled completely
     by setting the AllowOverride
     directive to none:
 
-    
-      AllowOverride None
-    
+    AllowOverride None
+


 How directives are applied
@@ -236,9 +235,8 @@ changes on a per-directory basis.
     In the directory /www/htdocs/example1 we have a
     .htaccess file containing the following:
 
-    
-       Options +ExecCGI
-    
+    Options +ExecCGI
+
 
     (Note: you must have "AllowOverride Options" in effect
     to permit the use of the "Options" directive in
@@ -247,9 +245,8 @@ changes on a per-directory basis.
     In the directory /www/htdocs/example1/example2 we have
     a .htaccess file containing:
 
-    
-       Options Includes
-    
+    Options Includes
+
 
     Because of this second .htaccess file, in the directory
     /www/htdocs/example1/example2, CGI execution is not
@@ -269,19 +266,16 @@ changes on a per-directory basis.
     prevent script execution while allowing anything else to be set in
     .htaccess you can use:
 
-    
-<Directory /www/htdocs>

-
-Allowoverride All

-
-</Directory>

-

-<Location />

-
-Options +IncludesNoExec -ExecCGI

-
+    
+<Directory /www/htdocs>
+    AllowOverride All
+</Directory>
+
+<Location />
+    Options +IncludesNoExec -ExecCGI

 </Location>
-    
+    
+
 
     This example assumes that your DocumentRoot is /www/htdocs.
 
@@ -307,13 +301,14 @@ Options +IncludesNoExec -ExecCGI

 
     .htaccess file contents:
 
-    
-      AuthType Basic

-      AuthName "Password Required"

-      AuthUserFile /www/passwords/password.file

-      AuthGroupFile /www/passwords/group.file

-      Require Group admins
-    
+    +AuthType Basic
+AuthName "Password Required"
+AuthUserFile /www/passwords/password.file
+AuthGroupFile /www/passwords/group.file
+Require Group admins
+    
+
 
     Note that AllowOverride AuthConfig must be in effect
     for these directives to have any effect.
@@ -329,11 +324,12 @@ Options +IncludesNoExec -ExecCGI

     the following configuration directives, placed in a
     .htaccess file in the desired directory:
 
-    
-       Options +Includes

-       AddType text/html shtml

-       AddHandler server-parsed shtml
-    
+    +Options +Includes
+AddType text/html shtml
+AddHandler server-parsed shtml
+    
+
 
     Note that AllowOverride Options and AllowOverride
     FileInfo must both be in effect for these directives to have any
@@ -349,19 +345,21 @@ Options +IncludesNoExec -ExecCGI

     the execution of CGI programs in a particular directory. This may be
     implemented with the following configuration:
 
-    
-       Options +ExecCGI

-       AddHandler cgi-script cgi pl
-    
+    +Options +ExecCGI
+AddHandler cgi-script cgi pl
+    
+
 
     Alternately, if you wish to have all files in the given directory be
     considered to be CGI programs, this may be done with the following
     configuration:
 
-    
-       Options +ExecCGI

-       SetHandler cgi-script
-    
+    +Options +ExecCGI
+SetHandler cgi-script
+    
+

Note that AllowOverride Options and AllowOverride FileInfo must both be in effect for these directives to have any @@ -387,7 +385,7 @@ Options +IncludesNoExec -ExecCGI None in effect.

If, on the other hand, you are getting server errors when trying to - access documents, check your Apache error log. It will likely tell you + access documents, check your httpd error log. It will likely tell you that the directive used in your .htaccess file is not permitted.

@@ -419,7 +417,28 @@ Options +IncludesNoExec -ExecCGI
ja | ko | pt-br

Apache Tutorial: .htaccess files

Apache HTTP Server Tutorial: .htaccess files

.htaccess files

Contents of .htaccess file in - `/www/htdocs/example`

Section from your `httpd.conf` - file

How directives are applied

Comments

Apache Tutorial: .htaccess files

Apache HTTP Server Tutorial: .htaccess files

.htaccess files

Contents of .htaccess file in - /www/htdocs/example

Section from your httpd.conf - file

How directives are applied

Comments

Contents of .htaccess file in - `/www/htdocs/example`

Section from your `httpd.conf` - file