The main configuration file of Apache is the ultimate arbitrator of what is allowable and not allowable for the .htaccess file to control and it will also yield to each directory higher than itself. If you wish for the .htaccess file to be able to change almost anything you use the directive "AllowOverride All" in the Apache configuration. You can also only grant specific rights like "AuthConfig" to allow the user to password protect specific areas.
One of the most basic features most people look for is the ability to provide password authentication to a particular directory and doing this is relatively easy. Change directory to the web accessible directory you want access to and then create an .htaccess file with the following information in it.
AuthType Basic AuthName "Protected Location, Credentials Please?" AuthUserFile /var/www/domain.tld/htdocs/protected/.htpasswd Require user valid-user
Then execute the following command:
htpasswd -c /var/www/domain.tld/htdocs/protected/.htpasswd testuser
At this point it will request you type the password for the user and will create an entry in the .htpasswd file. You only need to use the -c flag when you're doing the initial creation of the file, after the first time you can simply specify the file name and user to add to it.
If you attempt to access your site now you will be prompted to enter a user name and password, enter the user name and password you created in the previous step and it will allow you access and will not request user name and password again this session unless you clear the session cache.
Having authentication on the fly is useful but there are even more useful variations of this that can be used to provide easy access from known locations and password protected access from unknown locations. For example we'll start with our previous example and add the ability for anyone on the local lan to access it without a password:
AuthType Basic AuthName "Protected Location, Credentials Please?" AuthUserFile /var/www/domain.tld/htdocs/protected/.htpasswd Require user valid-user Order deny,allow Deny from all Allow from 192.168. Satisfy any
Now anyone attempting to access the protected content will have to meet one of two criteria-- either A) Be on the 192.168.0.0/16 subnet or B) Know the correct user name and password.
The .htaccess file however is not limited to just authentication changes you can also rewrite urls and redirect traffic if you wish:
Redirect 301 /old http://www.domain.tld/new
What this code says is redirect permanently (301) requests to /old to http://www.domain.tld/new. This is often useful if changed the management software on the website or made significant changes to the layout. That being said you rarely end up being able to use something as simple as that because frequently you use query strings in the requests (something following the base URL like: ?app=4&site=domain.tld&ref=9) to redirect those is a bit more complex:
RewriteEngine on
RewriteBase /
RewriteCond %{QUERY_STRING} ^article=0001$
RewriteRule ^main.php$ /article1 [R=301,L]
What this says is redirect any query to http://www.domain.tld/main.php?article=0001 to http://www.domain.tld/article1 and it's fairly easy to extend that to including part of the rewrite string in the resulting URL allowing you to redirect uniform urls en-mass to the correct location.
I'll share one more tidbit regarding the .htaccess file, you can also use it to prevent people from hot-linking to your images and stealing your bandwidth.
This doesn't always work due to needing to make exceptions for browsers that strip out the referer (the misspelling is intentional, it was misspelled in the RFC and has remained the same since.) The code to do this is pretty easy:
RewriteEngine On
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?domain\.tld/ [NC]
RewriteRule .*\.(jpe?g|gif|bmp|png)$ - [F]
What this rule says is for any request that doesn't originate from my domain return a forbidden response. You could further modify this to rewrite the url they are requesting and display the image of your choice. You could also allow blank referrers to access the site resources or deny any specific site you don't want hot-linking your site specifically (for instance, facebook or a competitor's site).
The flexibility the .htaccess file offers is massive and will allow you to write better sites and optimize your existing sites to better utilize your incoming links after a reorganization. The sky's the limit and with a bit of care and work you can create just about any rule set you can imagine.
