mod_rewrite is an Apache module that allows you to manipulate URLs using regular expressions. It works by intercepting incoming HTTP requests and applying pattern-matching rules defined in .htaccess files or Apache configuration. When a request URL matches a RewriteRule pattern, Apache transforms (rewrites or redirects) the URL based on the substitution you specify. Optional RewriteCond directives add conditions that must be satisfied before a rule is executed, giving you fine-grained control over when and how URLs are rewritten.

RewriteRule is the core directive that performs the actual URL transformation. It takes a regex pattern (matching the request path) and a substitution string. RewriteCond (Rewrite Condition) is an optional directive that precedes a RewriteRule and adds prerequisites. For example, a RewriteCond can check if the request is NOT coming from a specific host, or if a file does NOT exist on the server, before allowing the rule to execute. Multiple RewriteCond directives are combined with AND logic by default; use the [OR] flag to change this behavior.

Use a RewriteCond to check the %{HTTPS} variable and a RewriteRule to perform the redirect. Select the "Force HTTPS" template above, or manually configure:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

This checks if HTTPS is off and permanently redirects (301) to the HTTPS version while preserving the full URL path and query string.

The [L] (Last) flag tells Apache to stop processing any subsequent rewrite rules in the current context after the current rule matches. Without it, Apache continues evaluating later rules, which could unintentionally modify the URL further. However, note that in .htaccess files, the [L] flag does not completely stop all processing — Apache still re-injects the rewritten URL and starts the rule evaluation again from the top. This is why combining [L] with proper conditions is essential to avoid infinite redirect loops.

To hide .php extensions, you need two rules: one to internally rewrite clean URLs to the actual PHP files, and optionally another to externally redirect direct .php URLs to the clean version. Select the "Hide .php" template or use:

RewriteEngine On
# Internally rewrite /page to /page.php
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^([a-zA-Z0-9_-]+)/?$ $1.php [L]

The RewriteCond checks if a corresponding .php file actually exists before rewriting, preventing 404 errors.

Debugging mod_rewrite can be challenging. Here are the most effective approaches:

1. Enable RewriteLog (Apache 2.2 and earlier): RewriteLogLevel 3 in your config.
2. Use LogLevel (Apache 2.4+): Add LogLevel alert rewrite:trace3 to see detailed rewrite processing in the error log.
3. Test with .htaccess tester tools (like this generator paired with online sandboxes).
4. Add temporary redirect rules with unique markers to isolate which rule is (or isn't) matching.
5. Check Apache error logs — they often contain clues about syntax errors or infinite redirect loops.

Common pitfalls include:

• Forgetting RewriteEngine On — rules won't work without it.
• Infinite redirect loops — caused by rules that keep matching after rewriting (use [L] and add exclusion conditions like RewriteCond %{ENV:REDIRECT_STATUS} ^$).
• Not escaping dots in patterns — . matches any character in regex; escape literal dots as \..
• Using ^(.*)$ without anchoring — can match unexpected paths; always anchor with ^ and $.
• Mixing up $1 and %1 back-references — $N refers to RewriteRule captures, %N refers to RewriteCond captures.

An internal rewrite (no [R] flag) changes the URL server-side only — the visitor's browser address bar remains unchanged. This is used for clean URLs and framework routing. An external redirect (with [R=301] or [R=302]) sends a new URL back to the browser, which then makes a new request — the address bar updates. Use external redirects for SEO-critical URL migrations (301 permanent) and temporary moves (302). Use internal rewrites when you want friendly URLs without changing what the visitor sees.