Question

I am using .htaccess to show custom HTML page for errors (401, 404, 500 .. etc). I want to restrict direct access to the errors folder which contains the html pages. Inside of the .htaccess file of the errors folder, I have the following:

RewriteEngine on 
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain\.com
RewriteRule \.(html|htm)$ - [F] 

This does not really seem to work and I get:

a 500 Internal Server Error error was encountered while trying to use an 
ErrorDocument to handle the request.

What changes do I have to make to the .htaccess file to get this to work. I am also wondering if it would work if I stick the errors folder outside of the public_html folder?

Answer 1

In your .htaccess file, redirect all errors to one php file

ErrorDocument 403 /errors.php
ErrorDocument 404 /errors.php
ErrorDocument 500 /errors.php

in errors.php use $_SERVER[‘REDIRECT_STATUS’] with an if else statement to detect the errors and show custom messages

if($_SERVER['REDIRECT_STATUS'] == 403)
{
    die("Forbidden");
}
else if($_SERVER['REDIRECT_STATUS'] == 404)
{
    die("NOT FOUND");
}
else if($_SERVER['REDIRECT_STATUS'] == 500)
{
    die("Server Error");
}
else if($_SERVER['REDIRECT_STATUS'] == 200)
{
 // user is trying to directly access the errors page, redirect to index.php
 header("Location: index.php");
}
else
{
    // all other error codes
}

Here is a List of HTTP status codes. Write an else if statement for each error you want to detect. Undetected errors will fall in the else block