Redirecting bare domain names to the “www” subdomain¶

You can change your application’s .htaccess file so when visitors request your application’s URL without the www subdomain, the request redirects to the www subdomain. For example, requests to http://example.com will redirect to http://www.example.com.

The following lines in your Drupal application’s .htaccess file can enforce the redirection, but may cause problems in development:

# RewriteCond %{HTTP_HOST} !^www\. [NC]
# RewriteRule ^(.*)$ http://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Since the preceding lines unconditionally redirect visitors to a www subdomain, the redirection can cause problems if you configured the website to work with different domains, for example, with non-production environments. Instead, replace the commented lines with code like the following, changing the example to your own domain name:

RewriteCond %{HTTP_HOST} ^example\.com$ [NC]
RewriteCond %{HTTP_HOST} !\.acquia-sites\.com [NC]
RewriteRule ^(.*)$ http://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Redirecting traffic between HTTP and HTTPS¶

For Acquia-hosted websites, secure HTTPS connections end at the load balancer level, which can cause common .htaccess recipes for HTTPS redirects to not work as expected. Since the X-Forwarded-Proto Varnish header indicates to the web infrastructure if a request came in through HTTPS, you must confirm the header in your rewrite conditions.

The examples in each of the available redirect methods use rewrite rule flags. For a thorough explanation of the flags you can use, see RewriteRule Flags.

Redirecting all HTTP traffic to HTTPS¶

The following sample rule sets HTTP_X_FORWARDED_PROTO to https when accessing the website using HTTPS:

RewriteCond %{HTTPS} off
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Redirecting all HTTPS traffic to HTTP¶

If your website displays insecure content warnings because Google indexed your documents using the HTTPS protocol, you must redirect traffic from HTTPS to HTTP using the following group of rules:

RewriteCond %{HTTP:X-Forwarded-Proto} =https
RewriteRule ^(.*)$ http://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Redirecting all traffic to the “www” SSL domain¶

To force all traffic to use both the www domain and SSL (even if not initially requested), use the following rules:

# exclude Acquia domains
RewriteCond %{HTTP_HOST} !\.acquia-sites\.com [NC]
# exclude Acquia Cloud IDE preview sites
RewriteCond %{HTTP_HOST} !\.web\.ahdev\.cloud [NC]
# ensure www.
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
# ensure https
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Redirecting all traffic to the bare SSL domain¶

Cloud Platform Enterprise subscribers using the standard certificate model have the option of redirecting all traffic to a bare domain using the HTTPS protocol by using rules like the following:

# Redirecting http://www.domain.com and https://www.domain.com
# to https://domain.com
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^(.*)$ https://%1%{REQUEST_URI} [L,R=301]
# Redirecting http://domain.com to https://domain.com
RewriteCond %{HTTPS} off
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Redirecting all traffic from two or more domains to a single domain¶

If you have two or more domains pointing to your website, your search rankings can be demoted for duplicate content. Use the following code to redirect visitors from two or more domains to a single domain:

RewriteCond %{HTTP_HOST} ^www.domain.com$ [NC,OR]
RewriteCond %{HTTP_HOST} ^domain.com$ [NC,OR]
RewriteCond %{HTTP_HOST} ^domain.net$ [NC]
RewriteRule ^(.*)$ https://www.domain.net/$1 [R=301,L]

Acquia recommends placing these rules after other redirects, such as Redirecting all HTTP traffic to HTTPS or Redirecting all traffic to the bare SSL domain.

Excluding Acquia domains and non-production environments¶

To exclude the default Acquia domains from your redirects, or specific environments (such as Dev and Stage), add one or more of the following conditionals to the top of any group of rewrite rules:

RewriteCond %{ENV:AH_SITE_ENVIRONMENT} prod [NC] # only prod
RewriteCond %{ENV:AH_SITE_ENVIRONMENT} !prod [NC] # not prod
# exclude Acquia domains
RewriteCond %{HTTP_HOST} !\.acquia-sites\.com [NC]
# exclude Acquia Cloud IDE preview sites
RewriteCond %{HTTP_HOST} !\.web\.ahdev\.cloud [NC]

As an example, if you wanted to ensure all the domains redirected to https://www. except for Acquia default domains, you would use rules like the following:

# exclude Acquia domains
RewriteCond %{HTTP_HOST} !\.acquia-sites\.com [NC]
# exclude Acquia Cloud IDE preview sites
RewriteCond %{HTTP_HOST} !\.web\.ahdev\.cloud [NC]
# ensure www.
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
# ensure https
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Identifying and blocking nuisance bots¶

Bot traffic is the non-human traffic generated on your website. Some bot traffic is useful for search engines and digital assistants. However, malicious bots or unauthorized web crawlers can be a nuisance because they disrupt site analytics and create an outsize impact on your infrastructure utilization.

To keep such traffic at bay, Acquia recommends adding nuisance bots to .htaccess:

# BLEXBot marketing crawler.
#Mozilla/5.0 (compatible; BLEXBot/1.0; +http://webmeup-crawler.com/)"
RewriteCond %{HTTP_USER_AGENT} ^(.*)BLEXBot(.*)$
RewriteRule .* - [F,L]

# Moz Link Index Crawler.
#Mozilla/5.0 (compatible; DotBot/1.1; http://www.opensiteexplorer.org/
dotbot, [email protected])"
RewriteCond %{HTTP_USER_AGENT} ^(.*)DotBot(.*)$
RewriteRule .* - [F,L]

# Paid SEO bot.
#Curious George - www.analyticsseo.com/crawler"
RewriteCond %{HTTP_USER_AGENT} ^(.*)Curious\ George(.*)$
RewriteRule .* - [F,L]

You can get a list of all nuisance bots by accessing your website from your historical web analytics data.