.htaccess rules
Everything about the redirect rules themselves: how they are written, and where they point.
Syntax
These break the file. Apache refuses to parse an invalid directive, and an unparseable .htaccess returns 500 for every URL under the directory.
| Rule | Severity | What |
|---|---|---|
htaccess/no-flag-whitespace | error | No spaces inside the [...] flag list |
htaccess/space-before-flags | error | A space before the [...], or it is part of the target |
htaccess/valid-rewrite-flags | error | Flag names must be ones mod_rewrite knows |
htaccess/no-inline-comment | error | # only starts a comment at the start of a line |
htaccess/uppercase-rewrite-flags | warning | Write flags in upper case |
Rules that never match
These do not break anything. They simply never fire, and the request falls through to a 404 with nothing in the logs to say why.
| Rule | Severity | What |
|---|---|---|
htaccess/rewrite-engine-required | error | RewriteRule does nothing without RewriteEngine on |
htaccess/pattern-relative-to-dir | error | No leading slash, no repeated directory name |
htaccess/anchor-patterns | warning | Make an optional trailing group optional |
htaccess/no-greedy-capture | warning | ^(.+)/?$ swallows the slash |
htaccess/escape-literal-dots | warning | . is a wildcard; escape a literal dot |
Redirect targets
| Rule | Severity | What |
|---|---|---|
htaccess/no-open-redirect | error | Never build the target hostname from the request |
htaccess/https-target | warning | Redirect to https:// |
htaccess/github-raw-target | warning | Raw file URLs, not /blob/ pages |
htaccess/no-rawgit | error | RawGit has shut down; use jsDelivr |
htaccess/no-double-slash | warning | No // in the produced URL |
htaccess/no-self-redirect | warning | Point at the destination, not back at w3id.org |
htaccess/avoid-permanent-redirect | warning | A 301 cannot be taken back |
Directives and negotiation
| Rule | Severity | What |
|---|---|---|
htaccess/allowed-directives | error | No code execution, proxying, or access control |
htaccess/valid-cors-header | warning | Do not copy the truncated CORS line |
htaccess/no-406-fallback | warning | Ending negotiation in 406 answers nobody |
htaccess/no-options-directive | proposed | Options directives — open questions |
Back to the rule catalogue.