php - Codeigniter 4 default .htaccess file query

Solution:

Am I right in thinking this code forces the removal of thewww.

Yes, but only for HTTP (not HTTPS) requests, as governed by the first condition%{HTTPS} !=on.

If you are implementing HTTPS then you should remove the first condition and change theRewriteRule substitution string to redirect tohttps://.... But if you are wanting to redirect towww then you'll need to reverse the logic also:

# Redirect "example.com -> www.example.com"
# (In fact, redirect hostname that does not start "www.")
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
Copy code

Although, this particular method (as I've implied in the comment) will not necessarily work if you have other subdomains, unless you want all subdomains to have www sub-subdomains?!

Note that this is an external "redirect", not an internal "rewrite" as you'd stated in the comment.

If so - is this really best practice?

In terms of SEO or from a technical perspective? In terms of SEO there is no difference. Using awww subdomain can arguably have some technical benefits (isolating cookies and staging sites, etc.) - although this is mostly a matter of opinion and depends on your environment. It is really up to you. For some domain names, using awww subdomain just looks cumbersome.

But what is important is that you choose one or the other and redirect to the canonical URL in order to avoid potential duplicate content issues.

Using the domain apex (ie. no www subdomain) is simply CodeIgniters default.

force https for every URL - but it's causing an error if I usewww.

To clarify, the SSL cert you implement must include both the domain apex, ie.exmaple.com and the www subdomain, ie.www.example.com. Otherwise, you will naturally get browser security warnings when requesting the "other" (non-SSL) hostname.

RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
Copy code

This code is generally OK to force HTTP to HTTPS (providing the SSL cert is installed on your application server, ie. you're not using a front-end SSL proxy or non-standard implementation). However, the order you put this rule in relation to the rule above will depend on whether you intend to implement HSTS or not.

If you are intending to implement HSTS then you will need to redirect to HTTPS on the same host first, before the redirect to www. This will result in an unavoidable double redirect when requesting the non-canonicalhttp://example.com/ (but that is not "bad").

For example:

# 1. Redirect to HTTPS on the same host
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# 2. Redirect to non-www to www
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
Copy code

If, however, you are not intending to implement HSTS then you can reverse the two rules above and get at most one redirect for any non-canonical URL request.

You need to update the CodeIgniterbase_url to match your preference of www or not.