Apache .htaccess中SSL重定向与伪静态规则冲突问题求助

Alright, let's fix that frustrating 403 error you're hitting when redirecting from HTTP to HTTPS. Here's what's going wrong and how to fix it:

The Root Cause #

Your current rewrite rule order is backwards. Right now, when a user visits http://www.mylink.info/about.html:

1. The server first internally rewrites about.html to about.php (via your .html to .php rule)
2. Then it redirects the request to https://www.mylink.info/about.php
3. Your rule blocking direct access to .php files catches this and throws a 403 error

The fix is simple: move the HTTPS redirect rules to the very top of your rewrite block, so the protocol switch happens before any internal rewrites.

Modified .htaccess Code #

Here's the adjusted file with the HTTPS redirect placed correctly (I've added comments to highlight the change):

# Set the “ea-php55” package as the default “PHP” programming language.
AddType application/x-httpd-ea-php55 .php .php5 .phtml
# php -- END cPanel-generated handler, do not edit
suPHP_ConfigPath /home/myusername
order allow,deny
deny from all
AddType video/ogg .ogv
AddType video/mp4 .mp4
AddType video/webm .webm
AddType audio/mpeg .mp3
AddType audio/ogg .ogg
AddType audio/mp4 .m4a
AddType audio/wav /wav
Options -Indexes
Options +FollowSymLinks
DirectoryIndex index.php
# BEGIN Compress text files
AddOutputFilterByType DEFLATE text/html text/xml text/css text/plain
AddOutputFilterByType DEFLATE image/svg+xml application/xhtml+xml application/xml
AddOutputFilterByType DEFLATE application/rdf+xml application/rss+xml application/atom+xml
AddOutputFilterByType DEFLATE text/javascript application/javascript application/x-javascript application/json
AddOutputFilterByType DEFLATE application/x-font-ttf application/x-font-otf
AddOutputFilterByType DEFLATE font/truetype font/opentype
# END Compress text files
# BEGIN Expire headers
ExpiresActive On
ExpiresDefault "access plus 5 seconds"
ExpiresByType image/x-icon "access plus 2592000 seconds"
ExpiresByType image/jpeg "access plus 2592000 seconds"
ExpiresByType image/png "access plus 2592000 seconds"
ExpiresByType image/gif "access plus 2592000 seconds"
ExpiresByType application/x-shockwave-flash "access plus 2592000 seconds"
ExpiresByType text/css "access plus 604800 seconds"
ExpiresByType text/javascript "access plus 216000 seconds"
ExpiresByType application/javascript "access plus 216000 seconds"
ExpiresByType application/x-javascript "access plus 216000 seconds"
ExpiresByType text/html "access plus 600 seconds"
ExpiresByType application/xhtml+xml "access plus 600 seconds"
# END Expire headers
# BEGIN Cache-Control Headers
Header set Cache-Control "public"
Header set Cache-Control "public"
Header set Cache-Control "private"
Header set Cache-Control "private, must-revalidate"
# END Cache-Control Headers
# BEGIN Turn ETags Off
FileETag None
# END Turn ETags Off
AddType text/x-component .htc
AddHandler application/x-httpd-php .js
DirectoryIndex index.php
RewriteEngine on

# --- MOVED HTTPS REDIRECT TO THE TOP ---
# Redirect HTTP to HTTPS first
RewriteCond %{HTTPS} off
RewriteCond %{HTTP:X-Forwarded-SSL} !on
RewriteCond %{HTTP_HOST} ^mylink\.info$ [OR]
RewriteCond %{HTTP_HOST} ^www\.mylink\.info$
RewriteRule ^(.*)$ "https\:\/\/www\.mylink\.info\/$1" [R=301,L]

# Block direct access to .php files (only catches actual requests, not internal rewrites)
RewriteCond %{THE_REQUEST} \.php [NC]
RewriteRule \.php$ - [F,NC,L]

# Internally rewrite .html to .php
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.+?)\.html$ $1.php [NC,L]

# Catch-all for controller
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !^/favicon\.ico
RewriteRule ^ mycontroller.php [L]

Key Notes #

1. Rule Order Matters: By handling the HTTPS redirect first, we ensure the user is sent to https://www.mylink.info/about.html directly, then the server internally maps that to about.php without exposing the .php extension to the user.
2. Clear Browser Cache: Since you're using a 301 (permanent) redirect, your browser might have cached the old broken redirect. Clear your cache or test in incognito mode to see the fix working immediately.
3. PHP Block Rule: The rule blocking direct .php access uses %{THE_REQUEST}, which refers to the original request sent by the browser. Internal rewrites (like .html to .php) don't modify this value, so the rule won't interfere with your site's functionality—it only blocks users who try to visit .php URLs directly.

内容的提问来源于stack exchange，提问作者seaofinformation