I am looking for advice on the correct way to place my .htaccess settings within my httpd.conf. Here is the server httpd.conf with the htaccess placed within a directory as per most instructions I have found.

SuexecUserGroup "#502" "#502"
ServerName example.com
ServerAlias www.example.com
ServerAlias webmail.examplee.com
ServerAlias admin.example.com
DocumentRoot /home/example/public_html
ErrorLog /var/log/virtualmin/example.com_error_log
CustomLog /var/log/virtualmin/example.com_access_log combined
ScriptAlias /cgi-bin/ /home/example/cgi-bin/
ScriptAlias /awstats/ /home/example/cgi-bin/
DirectoryIndex index.html index.htm index.php index.php4 index.php5
<Directory /home/example/public_html>
Options -Indexes +IncludesNOEXEC +SymLinksIfOwnerMatch +ExecCGI
allow from all
AllowOverride All Options=ExecCGI,Includes,IncludesNOEXEC,Indexes,MultiViews,SymLinksIfOwnerMatch
AddHandler fcgid-script .php
AddHandler fcgid-script .php5
FCGIWrapper /home/example/fcgi-bin/php5.fcgi .php
FCGIWrapper /home/example/fcgi-bin/php5.fcgi .php5
<Directory /home/example/cgi-bin>
allow from all
AllowOverride All Options=ExecCGI,Includes,IncludesNOEXEC,Indexes,MultiViews,SymLinksIfOwnerMatch
RewriteEngine on
RewriteCond %{HTTP_HOST} =webmail.example.com
RewriteRule ^(.*) https://example.com:20000/ [R]
RewriteCond %{HTTP_HOST} =admin.example.com
RewriteRule ^(.*) https://example.com:10000/ [R]
RemoveHandler .php
RemoveHandler .php5
php_admin_value engine Off
IPCCommTimeout 61
FcgidMaxRequestLen 1073741824
Alias /pipermail /var/lib/mailman/archives/public
<Files awstats.pl>
AuthName "example.com statistics"
AuthType Basic
AuthUserFile /home/example/.awstats-htpasswd
require valid-user
<Directory /home/example/public_html>
AllowOverride None
<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig\.save)$">
  Order allow,deny
Options -Indexes
Options +SymLinksifOwnerMatch
ErrorDocument 404 /index.php
DirectoryIndex index.php index.html index.htm
<IfModule mod_php5.c>
  php_flag magic_quotes_gpc                 off
  php_flag magic_quotes_sybase              off
  php_flag register_globals                 off
  php_flag session.auto_start               off
  php_value mbstring.http_input             pass
  php_value mbstring.http_output            pass
  php_flag mbstring.encoding_translation    off
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresDefault A1209600
  <FilesMatch \.php$>
    ExpiresActive Off
<IfModule mod_rewrite.c>
  RewriteEngine on
  RewriteRule ^ - [E=protossl]
  RewriteCond %{HTTPS} on
  RewriteRule ^ - [E=protossl:s]
  RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
  RewriteRule "(^|/)\." - [F]
   RewriteCond %{HTTP_HOST} .
   RewriteCond %{HTTP_HOST} !^www\. [NC]
   RewriteRule ^ http%{ENV:protossl}://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_URI} !=/favicon.ico
  RewriteRule ^ index.php [L]
  <IfModule mod_headers.c>
    RewriteCond %{HTTP:Accept-encoding} gzip
    RewriteCond %{REQUEST_FILENAME}\.gz -s
    RewriteRule ^(.*)\.css $1\.css\.gz [QSA]
    RewriteCond %{HTTP:Accept-encoding} gzip
    RewriteCond %{REQUEST_FILENAME}\.gz -s
    RewriteRule ^(.*)\.js $1\.js\.gz [QSA]
    RewriteRule \.css\.gz$ - [T=text/css,E=no-gzip:1]
    RewriteRule \.js\.gz$ - [T=text/javascript,E=no-gzip:1]
    <FilesMatch "(\.js\.gz|\.css\.gz)$">
      Header set Content-Encoding gzip
      Header append Vary Accept-Encoding

Often Drupal updates come along and add in a .htaccess and due to my setup (virtualmin servers on a Centos machine) I have to go through each site after update and change the htaccess files on each so I would like any .htaccess to be ignored. Setting AllowOverride None in the public directory should block(ignore) these but then I am unsure if the subsequent Overrides have an impact on this.

The config works but is dirty (duplication and overrides of overrides :S) so in essence I would like to clear it up. What is provided is the raw drop in, I think I should be able to delete some permissions but not sure

Apache makes it very clear that if you have access to httpd.conf it SHOULD be used instead of .htaccess but I have been unable to find any info about the correct config for drupal apart from 'wrap in directory and drop it in'....

There is no clear documentation on Drupal.org so please don't bounce this over to SE or SO, it is very drupal centric and with D8 about to land and Apache 2.4 finally landing in many server repos htaccess and httpd.conf will cause many people headaches so this will be helpful to many drupalers !

Here is some additional for those that some who use .htaccess may not be aware of: From the Drupal Installation docs: Step 6: Configure clean URLs:

If you have complete control of your server, for example: You run your own server; are installing a development site on your personal computer; or you have a dedicated server hosting account, then you should enable clean URLs in the httpd.conf file for better performance and security.

Here is an outstanding D7 & D8 patch that is aiming to remedy some of the permission (override) issues that I am trying to clarify: +FollowSymLinks to +SymLinksIfOwnerMatch

  • 1
    This question appears to be off-topic because it is about webserver administration, not about Drupal.
    – Mołot
    Mar 28, 2014 at 11:17
  • @TaylorTaff I'm afraid this isn't Drupal-centric, the only discipline involved is Apache. You could ask "how do I move my Wordpress site's .htaccess content into httpd.conf", and the answer wouldn't change. As Gisle mentioned, the guys over at Pro Webmasters would be your best bet for help with Apache config
    – Clive
    Mar 28, 2014 at 11:21
  • I have added some additional information to the question. 1) A quote from the handbook regarding using httpd.conf where possible. 2) An open bug illustrating the need for additional configuration for Drupal rather than other system/CMS/platform. Drupal Answers help center states "If your question is about… Server administration/deployment ... …then you're in the right place to ask your question!" Mar 28, 2014 at 12:38
  • Other Questions which have been recently answered without query:drupal.stackexchange.com/questions/94558/… drupal.stackexchange.com/questions/94963/… MY question provides the full config rather than a partial which is helpful for those looking for a clear question and answer rather than a partial one. Mar 28, 2014 at 12:46
  • 1
    Thanks for taking the time to clear things up - clearly a Drupal question, I've re-opened it. Incidentally, I think "server administration" is in the Help Centre incorrectly there - the vast majority of server admin questions are off topic here. Will discuss with the other mods and remove if necessary
    – Clive
    Mar 28, 2014 at 13:12

1 Answer 1


I still don't know why more people do not use include like this. All you have to do is restart apache for changes in drupal's .htaccess to take effect.

<Directory "/var/www/html">
  Options Indexes FollowSymLinks
  AllowOverride none
  Order allow,deny
  Allow from all

  # For Drupal, the rules in .htaccess are included here.
  RewriteEngine on
  RewriteBase /
  Include /var/www/html/.htaccess

# Enforce new security rules from SA-CORE-2013-003.
<Directory "/var/www/html/sites/*/files">
  # Turn off all options we don't need.
  Options None
  Options +FollowSymLinks

  # Set the catch-all handler to prevent scripts from being executed.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
  <Files *>
    # Override the handler again if we're run later in the evaluation list.
    SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003

  # If we know how to do it safely, disable the PHP engine entirely.
  <IfModule mod_php5.c>
    php_flag engine off

Change /var/www/html to /home/example/public_html in your case.

  • I like the idea of using 'include', all the benefits of using a htaccess without the downsides. I changed the paths and tried to use it on a current site but I got a permission error. I will try on a fresh (default standard) install tomorrow. Mar 28, 2014 at 21:29
  • It's what we use so you should be able to get it to work.
    – mikeytown2
    Mar 28, 2014 at 21:32
  • If you do the includes like this does Apache ignore the .htaccess files then?
    – mpdonadio
    Mar 29, 2014 at 13:08
  • @MPD, my understanding is that the 'include' imports the specifically listed .htaccess files into httpd.conf . One issue with typical setups using .htaccess is that Apache is scanning every directory for .htaccess files. Using the 'include' method means it does not scan at all, instead taking the settings and loading them when Apache starts. Mar 29, 2014 at 13:11
  • 1
    @TaylorTaff Yeah, I get that, I use lots of includes in my Apache configs. I just did an experiment with this; not sure why I never tried this before. The Include directive gets the configuration into Apache. The AllowOverride none directive is what tells Apache to not scan for .htaccess files (or whatever you have AccessFile defined as).
    – mpdonadio
    Mar 29, 2014 at 13:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.