Canonical Apache Redirects: Remove index.html and index.php Safely

By Greg Nowak. Updated 13 October 2026.

If /, /index.html, and /index.php display the same page, your website has several addresses for one destination. Those variants can spread into campaign links, agency reports, and navigation. Cleaning them up gives your team one address to publish and maintain.

The usual solution is a permanent Apache redirect to the directory URL, keeping the visitor’s intended page and query parameters. The business brief is straightforward: old links should work, campaign tracking should survive, and enquiries should still arrive. The implementation needs to account for your CMS, hosting, and any proxy in front of Apache.

Agree the destination before writing rules

Compare the content and behaviour at each address first. An old index.html landing page and a newer index.php application are not automatically equivalent. If they differ, decide which content to retain before redirecting either one.

Preserve the directory: /services/index.php should normally become /services/, rather than the homepage. Choose the preferred hostname and HTTPS destination at the same time, so visitors can reach the final address in one redirect.

Google recommends permanent server-side redirects for permanent URL changes and treats them as a canonicalization signal. That supports a consistent URL preference; it does not guarantee a ranking increase.

Choose where the redirect belongs

Apache recommends the main configuration when you have access. On shared hosting, confirm that mod_rewrite is enabled and rewrite directives are permitted through AllowOverride FileInfo or an appropriate AllowOverrideList. An ignored or disallowed file needs a hosting configuration fix.

A document-root .htaccess example

This Apache 2.4 example handles GET and HEAD requests, combines filename removal with hostname and HTTPS normalization, and assumes Apache receives the public TLS connection. Replace example.com with your preferred domain. Place it before CMS routing rules, outside any block the CMS regenerates.

RewriteEngine On

# Explicit index request: redirect to the final directory URL
RewriteCond %{REQUEST_METHOD} ^(?:GET|HEAD)$
RewriteCond %{THE_REQUEST} "\s/+(?:[^?\s]*/)?index\.(?:html|php)[?\s]"
RewriteRule ^(.*/)?index\.(?:html|php)$ https://example.com/$1 [R=301,END]

# Other page requests: normalize hostname and protocol
RewriteCond %{REQUEST_METHOD} ^(?:GET|HEAD)$
RewriteCond %{HTTP_HOST} !^example\.com$ [NC,OR]
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://example.com%{REQUEST_URI} [R=301,END]

For example, http://www.example.com/services/index.php should redirect directly to https://example.com/services/. The destination hostname is fixed rather than copied from the request.

These patterns are for a document-root .htaccess and ordinary, unencoded paths. Moving them into a virtual host or subdirectory requires adjustment. Review uppercase filenames, encoded characters, and routes such as /index.php/products separately. HTTPS aliases also need valid certificates before a redirect can happen.

Protect CMS routing and campaign parameters

THE_REQUEST checks the original client request. It distinguishes someone requesting /index.php from a CMS internally routing a clean URL through that file. Without that distinction, an index-removal rule can interfere with normal routing. See Apache’s mod_rewrite reference for request variables and rule contexts.

Neither destination in this example supplies a query string, so Apache retains the existing one. A request for /services/index.php?utm_source=newsletter should become /services/?utm_source=newsletter. You do not need QSA here. The QSD flag discards the entire query string; use it only after checking that no tracking or application parameters are needed. These behaviours are documented in Apache’s rewrite flags guidance.

The method conditions deliberately leave POST submissions outside this example. If forms, payment callbacks, or integrations use an index URL, agree their routing separately and retain the existing HTTPS policy for those endpoints.

Check that DirectoryIndex serves the intended content at the clean directory URL. Keep DirectoryIndexRedirect off for this approach: enabling it redirects back to the index resource and can create a loop. Leave normal directory slash handling enabled unless your application has a specific requirement. See Apache’s mod_dir documentation.

Check the hosting stack for competing redirects

If a proxy terminates HTTPS, Apache may see HTTP even when the visitor used HTTPS. The example’s HTTPS condition then needs an infrastructure-specific replacement. Trust forwarded protocol information only from a known proxy that overwrites the header, with direct backend access restricted.

Review hosting-panel redirects, CDN rules, and CMS plugins together. An earlier HTTP-to-HTTPS rule may add a hop before filename removal. This example also does not combine every trailing-slash correction. Test through the public hostname, and check certificate-renewal routes if you change HTTP handling.

Test the visitor journey before making it permanent

Save the previous configuration and test in staging. Use R=302 in both rules during initial checks, then switch to R=301 when the mapping is approved.

curl -IL --max-redirs 5 'http://www.example.com/index.php'
curl -IL --max-redirs 5 'https://www.example.com/services/index.html?utm_source=test'
curl -IL --max-redirs 5 'https://example.com/services/'

For these examples, expect one redirect from each old address and a final 200 response. The preferred clean URL should return directly. Inspect every Location header and confirm that the directory and query string survive. These commands use HEAD; also test browser GET requests, page content, and an actual enquiry submission.

Finish by updating internal links, canonical elements, sitemaps, and campaign templates. Record the mappings, exceptions, test results, and rollback steps. After release, check logs for unexpected redirects or errors.

If the work spans your host, developer, and marketing agency, Greg can help coordinate the redirect plan and rollout checks. Bring a few affected URLs and the names of the systems involved.

Regex redirects and rewrite references

Reading on redirects with regular expressions:

• Basic intro to regex rewrite and redirect
• .htaccess 301 redirect with regular expressions (Super User)
• .htaccess redirect to a new URL using regex (WordPress SE)
• .htaccess 301 redirect with regex (Webmasters SE)
• Regular expressions in .htaccess for 301 redirects (Stack Overflow)

RewriteRule generator: https://donatstudios.com/RewriteRule_Generator

Related on GrN.dk

• AI Content on Google: Which Pages Are Worth Keeping?
• Google’s AI Search toggle needs a test plan, not a gut decision
• Cloudflare Page Rules Debt: How Quiet Configuration Drift Breaks Business Websites

Need help with this kind of work?

Plan your redirect rollout with Greg Get in touch with Greg.

Sources

• Apache mod_rewrite Reference
• Apache RewriteRule Flags
• Apache mod_dir Reference
• Apache HTTP Server Tutorial: .htaccess Files
• Redirects and Google Search