Hide PHP Extension In URL Using HTACCESS (Simple Examples)

Welcome to a quick tutorial on how to hide the PHP file extension in the URL. Don’t want to show an ugly PHP file extension or want to hide it away for security purposes?

This covers the quick basics, but let us walk through a couple of examples to play with the URL rewrite – Read on!

ⓘ I have included a zip file with all the example source code at the start of this tutorial, so you don’t have to copy-paste everything… Or if you just want to dive straight in.

 

 

TLDR – QUICK SLIDES

Fullscreen Mode – Click Here

 

TABLE OF CONTENTS

 

 

QUICK NOTES

• Please enable the URL rewrite module in httpd.conf – LoadModule rewrite_module modules/mod_rewrite.so
• Also in httpd.conf, make sure that AllowOverride is properly set for your HTTP folder (the easiest is to set AllowOverride All).

If you spot a bug, feel free to comment below. I try to answer short questions too, but it is one person versus the entire world… If you need answers urgently, please check out my list of websites to get help with programming.

 

EXAMPLE CODE DOWNLOAD

Click here to download the source code, I have released it under the MIT license, so feel free to build on top of it or use it in your own project.

 

 

 

METHOD 1) OFFICIAL SOLUTION – OBFUSCATED FILE TYPE

# (A) CONFUSE PEOPLE - PY OR ASP FILES ACTUALLY CONTAIN PHP CODE
AddType application/x-httpd-php .py .asp
 
# (B) OR USE AN UNKNOWN FILE TYPE
AddType application/x-httpd-php .foo .bar

Believe it or not, this is the actual official solution from the PHP website. What we do is rename .php into another extension such as .py, .asp, or .foo, but process them as PHP scripts in the .htaccess file. While I personally don’t agree with it, it does somewhat serve to confuse people.

P.S. This is a bad solution, what if the server has to support more than one language? This will definitely clash with Python, ASP, and cause serious confusion among developers.

 

 

METHOD 2) SIMPLE URL REWRITE

# (A) REWRITE ON
RewriteEngine on
 
# (B) DO NOT OVERRIDE EXISTING FOLDERS
RewriteCond %{REQUEST_FILENAME} !-d
 
# (C) REWRITE PHP FILES ONLY
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^([^\.]+)$ $1.php [NC,L]

As in the introduction above, what this means in English:

• RewriteEngine on Turn the URL rewrite engine on.
• RewriteCond %{REQUEST_FILENAME} !-d Do not override existing folders.
• RewriteCond %{REQUEST_FILENAME}.php -f Rewrite only if it is a .php file.
• RewriteRule ^([^\.]+)$ $1.php [NC,L] Attempt to “map” http://SITE.com/PAGE to http://SITE.com/PAGE.php.

Yep, as simple as that. Four lines, problem solved.

 

METHOD 3) SIMPLE PRETTY URL WITH PHP

3A) HTACCESS – POINT EVERYTHING TO INDEX

# (A) REWRITE ON
RewriteEngine On
 
# (B) DO NOT OVERRIDE HTTP AUTH
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

# (C) MAKE SURE THE REWRITEBASE IS CORRECT
# I.E. IF HTTP://SITE.COM/FOLDER/, BASE SHOULD BE /FOLDER/
RewriteBase /
 
# (D) DO NOT OVERRIDE EXISTING FILES FOLDERS
RewriteRule ^3b-index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f 
RewriteCond %{REQUEST_FILENAME} !-d 

# (E) MAKE SURE PATH IS CORRECT
# IF HTTP://SITE.COM/FOLDER/, SHOULD BE /FOLDER/3B-INDEX.PHP
RewriteRule . /3b-index.php [L]

Combining .htaccess with PHP, we can create a good page template system – Here is the .htaccess file “borrowed” from WordPress. Not going to explain line by line. But in plain English, this means “point everything to 3b-index.php but leave the existing files and folders alone”.

 

 

3B) INDEX – PAGE LOADER & HANDLER

<?php
// (A) SETTINGS
define("URL_PATH", "/"); // CHANGE THIS IF NOT ROOT!
define("PATH_PAGES", __DIR__ . DIRECTORY_SEPARATOR . "pages" . DIRECTORY_SEPARATOR);

// (B) STRIP PATH DOWN TO AN ARRAY 
// HTTP://SITE.COM/HELLO/WORLD/ > $_PATH = ["HELLO", "WORLD"]
$_PATH = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH); 
$_PATH = substr($_PATH, strlen(URL_PATH)); 
$_PATH = rtrim($_PATH, '/');
$_PATH = explode("/", $_PATH);

// (C) FILE NAME YOGA
// $_PATH = ["HELLO", "WORLD"] > $_FILE = "HELLO-WORLD.PHP";
// $_PATH = [] > $_FILE = "HOME.PHP";
if (count($_PATH) > 1) { $_FILE = implode("-", $_PATH) . ".php"; }
else { $_FILE = ($_PATH[0]=="" ? "home" : $_PATH[0]) . ".php"; }

// (D) LOAD PAGE - CREATE YOUR OWN HTML TEMPLATE IF YOU WANT
if (file_exists(PATH_PAGES . $_FILE)) {
  // require "TOP-HALF.PHP";
  require PATH_PAGES . $_FILE;
  // require "BOTTOM-HALF.PHP";
}
 
// (E) NOT FOUND - SERVE YOUR OWN CUSTOM 404 PAGE IF YOU WANT
else {
  http_response_code(404);
  echo "OOPS. FILE NOT FOUND";
}

In the “index page handler”, we simply break the path portion of the URL down and load the respective page. For example, http://site.com/test/ will load pages/test.php. Yep, feel free to create your own HTML template system here, or even load contents from the database.

 

3C) DUMMY PAGE

<!DOCTYPE html>
<html>
  <head>
    <title>TEST!</title>
  </head>
  <body>
    <p>This is a test page!</p>
  </body>
</html>

 

 

 

HOW ABOUT IIS & NGINX?

If you using IIS or NGNIX – Don’t worry. Both of them also offer URL rewrite, and the idea behind this guide will still kind of work. But the syntax for both web servers is different, and you will need to do some homework.

• URL Rewrite for IIS
• URL Rewrite for NGINX

 

LINKS & REFERENCES

• URL Rewrite – Apache
• Allow Override Directive – Apache

 

INFOGRAPHIC CHEAT SHEET