Canonical Apache Redirects: Remove index.html and index.php Cleanly

By Greg Nowak. Updated 6 August 2026.

When /, /index.html, and /index.php display the same page, the website has several public addresses for one piece of content. Visitors may not notice, but duplicate URLs fragment analytics, make campaign reports harder to interpret, and add unnecessary checks to migrations and agency handovers.

The practical fix is to choose one public URL and permanently redirect the alternatives to it. For most businesses, that means HTTPS, one preferred hostname, and no visible default filename. The important part is not finding a clever rewrite snippet. It is making the policy explicit, avoiding redirect chains, and ensuring the rest of the website uses the same URLs.

Define the final URL before touching Apache

Decide whether the canonical hostname is example.com or www.example.com. Then decide whether directory URLs should end with a slash. For a request such as /services/index.php, the usual destination is https://example.com/services/.

Treat this as a small URL-governance decision rather than an isolated SEO fix. Internal links, canonical elements, XML sitemaps, hreflang annotations, campaign templates, and reporting dashboards should all point to the chosen version. Google regards permanent server-side redirects as a strong canonicalization signal, but consistent supporting signals make the result easier to understand and maintain.

A practical document-root .htaccess rule

The following Apache 2.4 example removes explicitly requested index.html and index.php filenames, while also enforcing HTTPS and a non-www hostname. Replace example.com with the real canonical domain. These patterns assume the file is the document-root .htaccess; patterns differ in virtual-host context.

RewriteEngine On

# Explicit index file: go directly to the final host and protocol
RewriteCond %{THE_REQUEST} "\s/+(.*/)?index\.(?:html|php)(?:[?\s])" [NC]
RewriteRule ^(.*/)?index\.(?:html|php)$ https://example.com/$1 [R=301,END]

# Every other request: enforce HTTPS and the canonical hostname
RewriteCond %{HTTP_HOST} !^example\.com$ [NC,OR]
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://example.com%{REQUEST_URI} [R=301,END]

Rule order matters. A request for http://www.example.com/services/index.php should go straight to https://example.com/services/, rather than changing protocol, hostname, and filename in three separate responses.

The fixed destination hostname also avoids reflecting an arbitrary incoming Host header into the redirect. If the site legitimately serves several domains, write an explicit policy for each one instead of turning unvalidated request data into a destination URL.

Why THE_REQUEST prevents CMS redirect loops

THE_REQUEST contains the original HTTP request line sent by the client. It therefore distinguishes a visitor asking for /index.php from a CMS internally routing a clean URL through index.php. Redirecting based only on an internally rewritten path can interfere with front-controller applications or create loops.

The rule does not alter Apache’s DirectoryIndex behavior. Apache can continue serving index.php internally when someone visits /; the filename simply disappears from the public address.

Query strings are retained because the redirect target does not define a new one. Thus, /services/index.php?utm_source=newsletter becomes /services/?utm_source=newsletter. If a legacy parameter must be removed deliberately, use Apache’s QSD flag and document the reason. Do not discard tracking or application parameters accidentally.

Handle server configuration and proxies deliberately

When you control Apache, virtual-host configuration is usually easier to audit and more efficient than distributed .htaccess files. Apache recommends the simpler Redirect directive when a plain prefix redirect is sufficient. However, mixing a protocol redirect in one scope with filename-removal rules in another can introduce an extra hop. Test the combined cases, not just each rule separately.

If TLS terminates at a reverse proxy, %{HTTPS} may be off on the backend even though the browser used HTTPS. In that architecture, use the proxy’s forwarded-protocol value only when the proxy overwrites the header, direct backend access is restricted, and the trust boundary is documented. Otherwise, a spoofed header can bypass policy or an incorrect condition can create an endless redirect.

Also verify certificate renewal after changing port 80 behavior. Let’s Encrypt recommends keeping port 80 available and supports HTTP-to-HTTPS redirects for HTTP-01 validation, but the complete proxy, firewall, and ACME-client path still needs a real renewal test.

Test before making the redirect permanent

Use a temporary 302 while validating a new rule if browser caching could slow down corrections. Once the map is correct and intended to remain, change it to 301.

curl -IL 'http://www.example.com/index.php'
curl -IL 'https://www.example.com/services/index.html?utm_source=test'
curl -IL 'https://example.com/services/'

For each case, confirm that the first response points directly to the intended URL, the final response is 200, the query string survives where required, and the clean URL does not redirect again. Then crawl the site for old internal links and update sitemaps, canonical elements, campaign templates, monitoring checks, and documentation.

A redirect rule is small infrastructure, but its effects reach search, analytics, advertising, and future development work. If your rules span a CMS, proxy, CDN, or migration map, Greg can help turn them into a testable implementation plan before they reach production.

Related on GrN.dk

• Google’s AI Search toggle needs a test plan, not a gut decision
• If the Facts Need JavaScript, AI Search May Miss the Full Page
• Google’s 2026 AI Search Guidance: SEO Still Counts, Reporting Changes

Need help with this kind of work?

Talk to Greg about your redirect plan Get in touch with Greg.

Sources

• Apache mod_rewrite Introduction
• Apache RewriteRule Flags
• Apache mod_rewrite Technical Details
• Redirects and Google Search
• Best Practice — Keep Port 80 Open