Changes to .htaccess ignored

Unbelievable. Remember how I said this is a development server? Yeah.. well here's what my virtual host entry REALLY looks like:

<VirtualHost *>
    ServerName              dev.ourwebsite.com
    DocumentRoot            /var/www/html/dev.ourwebsite.com/docroot
    <Directory "/var/www/html/ourwebsite.com/docroot">
        Options FollowSymLinks
        AllowOverride All

        Order allow,deny
        Allow from all
    </Directory>
</VirtualHost>

Do you see it? Well I didn't. I FORGOT To change my "Directory" entry to dev.ourwebsite.com instead of ourwebsite.com -- and that made all the difference. I just assumed that Apache would have thrown an error if the directory didn't exist; but that only applies to the DocumentRoot directive. is match-based -- meaning it applies the rules if it matches the incoming request, but otherwise, it doesn't care if you tell it to AllowOverride on magic unicorns.

Let this be a lesson to any others who come looking -- when all else fails, consider the almighty Typo.

But it's getting very long and of course requires a reboot any time a change gets made.

If length is a problem, then consider breaking out configuration sections and using the Include directive instead. As others have said, it's possible to reload the httpd configuration with 'reload' or 'restart', and this should reduce disruption for your users. You'd need to train your administrators to use 'reload' or 'graceful', which is easier said then done-- many people don't know about these commands, and some people don't trust them.

Here are some reasons why .htaccess files are considered evil:

1. .htaccess files cause confusion. I once inherited a site which had over 50 .htaccess files throughout the directory hierarchy, which were created by dozens of different people spanning back 6 years. It was very difficult to figure out the "server configuration" for any particular directory, or why certain features didn't work on certain directories.

2. Security: Any user who can write to the .htaccess file can override some of your carefully thought-out settings which you placed in httpd.conf , unless you take care to restrict the available options with AllowOverride. See When (not) to use .htaccess files for more information.

3. Auditing: It's easy to create a configuration management for your main httpd.conf and Include'd directories. This provides a nice audit trail of who did what. It's more difficult to implement configuration management when the configuration files are spread throughout the directory hierarchy.

4. Loss of control: It's possible for someone to create an .htaccess file and not tell you. Pretend someone did this at 5PM on a Friday, added a bunch of mod_rewrite rules which did the wrong thing and broke a bunch of pages, and then the person left for the weekend. You don't discover the problem until Monday.

There are certainly cases where .htaccess files make sense-- if there are only a handful of .htaccess files, and the purpose of each is well understood.