Problem: I want to restrict direct node access using node number www.example.com/node/12 and allow access using pathauto alias www.example.com/content/sometitle to anonymous user. This user should be allowed to see all content of node using only Pathauto title path but not with node number to snoof.

Mostly I want to target anonymous users. Admin always has access to everything.

In simple terms, I want to redirect all node/Number paths (not node/add/ContentType) to say the Home page or No Access page.


3 Answers 3


The Global Redirect module does what you want (and more).

... Checks if the Clean URLs feature is enabled and then checks the current URL is being accessed using the clean method rather than the 'unclean' method.

It redirects the node/xx to content/your-content etc if clean URLs feature is enabled.

  • Thanks. But I want to completely block access to node/xx and allow only content/your-content.
    – suneel
    Commented Jul 11, 2015 at 15:55
  • @suneel, by using the Global Redirect module it's not possible to access node/xx. It redirects to the content/your-content. If you try it you can see what I mean.
    – herci
    Commented Jul 11, 2015 at 15:57
  • Thanks Herci for your prompt reply. I tried the module. Even if type node/xx it is redirected to content/your-content. But I do not want user or robot to simply poll for node/xx to get some node info and copy my sites data. If I block, node/xx access, I am free from robot attacks. Robot can not know or guess content/your-content titles and hence fails.
    – suneel
    Commented Jul 11, 2015 at 16:06
  • You can restrict access by editing your robots.txt; have you tried it?
    – herci
    Commented Jul 11, 2015 at 16:11
  • I do not mean robots by robots.txt which helps search engines to crawl webpages. I mean those spammers who uses some automation code to copy all data of nodes just using some while(node/xx) returns a page, copy the data to local disk and then use data in their sites. For example I can copy all data of this forum posts, drupal.stackexchange.com/questions/xxx just by incrementing xxx from 1 to xxx and post in my website.
    – suneel
    Commented Jul 11, 2015 at 16:32

Option 1: Using the Rules module

Using the Rules module you can implement a rule that looks similar to this:

{ "rules_check_url" : {
    "LABEL" : "Disallow node/* access",
    "PLUGIN" : "reaction rule",
    "OWNER" : "rules",
    "REQUIRES" : [ "rules" ],
    "ON" : { "init" : [] },
    "IF" : [
      { "text_matches" : {
          "text" : [ "site:current-page:url" ],
          "match" : "node\/\\d+$",
          "operation" : "regex"
    "DO" : [
      { "drupal_message" : {
          "message" : "Sorry, URLs like [site:current-page:url] are not allowed around here ...",
          "type" : "error"
      { "redirect" : { "url" : "no_access" } }

The above rule does not (yet) take into account to only apply the "action" for anonymous users only. But for anybody a bit familiar with the Rules module, that is a straight forward "Condition" to add ...

To experiment with this rule in your own site, just copy the entire Rules code above, and paste it in a new Rule in your own site, created via the "Import" function. Then further edit/refine to make it fit in your own environment (e.g the "Sorry, ..." message to be shown).

Option 2: Using theRabbit Hole module

Consider using the Rabbit Hole module. Here is an excerpt from its project page:

... providing multiple options to control what should happen when the entity is being viewed at its own page. You have the ability to

  • Deliver an access denied page.
  • Deliver a page not found page.
  • Issue a page redirect to any path or external url.
  • Or simply display the entity (regular behavior).

This is configurable per bundle and per entity. There is also a permission that lets certain roles override Rabbit Hole completely.


From both options provide above, I'd pick the Rules based solution ... Either because you might already have Rules installed, or if you have to still install it you'll discover tons of other use case to also be resolved by the same Rules module (possibly complemented with the Flag module soon ...)

  • This is wrong. Rabbit hole will not allow the node to be visited at all, which is the only requirement of the question. The rules approach is bloated and ugly and should be avoided like the plague as always. Using Global Redirect is the proper solution to this problem.
    – Clive
    Commented Apr 21, 2017 at 9:41

You can by pass Drupal altogether with an Apache mod_rewrite rule. Place this in your root .htaccess file in between the <IfModule mod_rewrite.c> directive.

RewriteRule ^node/([0-9]+)$ / [R=301,L]

It will redirect all www.example.com/node/* to www.example.com. If you're want to redirect to another path, append it the single "/" character.

  • Best answer IMO, but I would go with 404 instead. Redirect shows that there is something special about /node/number path, and OP seems not want this. Also, as an user I hate unexpected redirects. If what I look for isn't there, I want to be told it isn't there. "Rule of least surprise" as I call it.
    – Mołot
    Commented Jul 12, 2015 at 11:03
  • Note, Apache will not let you do this. Per the docs..."However, if a status code is outside the redirect range (300-399) then the substitution string is dropped entirely, and rewriting is stopped as if the L were used."
    – Shawn Conn
    Commented Jul 12, 2015 at 23:51
  • That's the point: to generate 404 without (unexpected) redirection. Just like path that doesn't exist at all.
    – Mołot
    Commented Jul 13, 2015 at 5:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.