How to close your website for maintenance with Apache .htaccess

You should, and almost always can, perform maintenance on your site without closing it down, but people sometimes ask how to take a site offline, so here are some methods.

#1 can be implemented in 1-2 minutes but is bad because it will confuse visitors and you might lose search engine ranking or indexing for pages crawled during the downtime. However, you could use this method briefly during the time it takes to install one of the other two.

#2 (better) and #3 (best) are recommended by Google.

Only a dire emergency justifies taking a site offline, but if your site was hacked and contains extremely offensive material or viruses, closing it while you repair it will protect your visitors, prevent offensive content from getting indexed under your site's name, and probably prevent getting the "This site may harm your computer" warning in Google results. If you were hacked, see also Step By Step Repair After A Website Hack.

All these methods close the site to normal HTTP browser and crawler traffic. You can use your control panel and FTP, and your FTP users will have access, too.

The time your site is closed should be kept to the absolute minimum required to make it safe.

1) The fastest way to take your site offline: deny

This method uses 2 lines of .htaccess code to deny web access. Anyone requesting a file gets a "403 - Forbidden" error page instead.

The severe drawbacks are:

• Visitors wonder why they are "Forbidden".
• Search engine robots might reclassify the page as Forbidden. When, or whether, they will return is unknown.

1. Go to cPanel > File Manager.
2. Navigate to the file public_html/.htaccess. If an .htaccess file is not already there, create it as a text file. Make sure it has the leading period.
3. Click on its file name (not the icon next to it).
4. In the upper right corner of the screen, click Edit File.
5. In a part of the file that is not between HTML-style tags like <tag></tag>, type the lines:
   
   order allow,deny
   deny from all
   
   Further explanation: some lines of your .htaccess file might be contained between tags that look like HTML tags where the opening tag looks like <tag> and the closing tag looks like </tag>. Insert these new lines in a part of the file that is not between any of these pairs of tags.
    
6. Click Save.

To reopen your site, remove the two .htaccess lines you added.

In addition to the purpose described here (closing the whole site), this method is useful whenever you need to make an individual folder inaccessible by web. Just put an .htaccess file with the above 2 lines in the folder you want to close.

.htaccess instructions apply to the folder where .htaccess is located and all its subdirectories. That is why, when you put this code in your top level public_html/.htaccess, it closes the entire site.

Information about the lines of code shown above can be found at http://httpd.apache.org/docs/1.3/mod/mod_access.html.

2) A polite way to take your site offline: redirect

This method uses a code 307 Redirect to serve a "Site Closed for Maintenance" page instead of whatever page was requested. The 307 code tells search engine crawlers that this is a temporary condition, and the text on the page informs visitors what the problem is.

Cautions

This method uses Apache's mod_rewrite, and it can conflict with the Microsoft FrontPage Extensions and also with cPanel's implementation of "Hotlink Protection".

FrontPage

Do not publish with FrontPage HTTP while the code below is installed. It probably will not work unless you apply the modifications described in a previous article, and I'm not even sure it will work then. I haven't tested it.

cPanel Hotlink Protection

The .htaccess code below also conflicts with cPanel's Hotlink Protection. The reasons are given in the same previous article. To reduce the chances of corrupting your .htaccess:

1. Comment out (with #) all of cPanel's Hotlink Protection code before you add this new code. 
2. Do not modify Hotlink Protection through the cPanel graphical interface while this other code is in your .htaccess.
3. When you are finished, remove or comment out all of this code and un-comment the original Hotlink Protection code.

Procedure

1. Create a simple page called maintenance.html (see below) that says something like "Site temporarily closed for maintenance." This page should be completely self-sufficient, with no links to stylesheeets, images, or any other page or object. This is because maintenance.html itself is the only file for which requests will be allowed. All others will be refused. If you must allow other files, create additional lines for them where indicated below.
    
2. Make a backup copy of your public_html/.htaccess file, so you can revert to it if there are problems.
    
3. Redirect incoming requests to your maintenance.html page:

In .htaccess, add lines like this. You might have to adjust them depending on what rewrite code is already in the file:

RewriteEngine On
RewriteBase /
#When enabled, the next code line allows testing.
#It says only do the rewrite if the request is from YOU.
#Thus, you can close the site to only yourself to make sure it works,
#then comment out the line again to close the site to everyone.
#Set it to your actual IP address at the time of the test.
#RewriteCond %{REMOTE_ADDR} ^111\.222\.333\.444$

#The remaining lines close the site.
#They say: if the request is NOT for /maintenance.html, redirect to it.
#You MUST allow at least one file to be served and NOT redirected,
#(maintenance.html in this example), to prevent endless looping.
RewriteCond %{REQUEST_URI} !^/maintenance\.html$
#To allow another file, copy the line above to here and change the filename.

#This line says: no matter what file was requested, serve maintenance.html.
#This is a redirect, so the full URL is required.
RewriteRule ^(.*)$ http://yourdomain.com/maintenance.html [R=307,L]

3) Best: return code 503 - Service Unavailable

This method is similar to #2, but instead of using a Redirect, it Rewrites the request to a PHP file that returns an HTTP response code of "503 - Service Unavailable". The 503 code tells search engines that this is a temporary problem with the server, and it even tells them when it's ok to come back. The text on the page tells visitors what the problem is.

If you use the FrontPage Extensions or cPanel Hotlink Protection, see the cautions at #2 above, which also apply here.

The .htaccess code is similar to #2, but most comments are removed:

RewriteEngine On
RewriteBase /
#For testing, only do the rewrite if the request is from YOU.
#RewriteCond %{REMOTE_ADDR} ^111\.222\.333\.444$

RewriteCond %{REQUEST_URI} !^/maintenance\.php$
#This is a rewrite, so the full URL is not used.
RewriteRule ^(.*)$ /maintenance.php [L]

Example maintenance.php / maintenance.html

Here is a maintenance.php you can use for method #3. The first line that says <?php must be at the very top of the file, with nothing, not even a blank line, above it.

Retry-After tells robots how long to wait (in seconds) before trying again. It is set here to 48 hours to allow for cleaning up a badly damaged website.

To use as maintenance.html for method #2, remove the top 5 lines (the PHP code).

<?php
header('HTTP/1.1 503 Service Temporarily Unavailable',true,503);
header('Status: 503 Service Temporarily Unavailable');
header('Retry-After: 172800');
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" 
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Language" content="en-us">
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<meta name="robots" content="noindex,nofollow">
<title>503 - Temporarily Closed For Maintenance</title>
<style type="text/css">
<!--
p
{
	font-family: "Verdana", sans-serif;
}
-->
</style>
</head>
<body>

<p><b>Name of website</b></p>
<p>is temporarily closed for maintenance.</p>
<p>Normal operation will resume as soon as possible.</p>

</body>
</html>

Questions? Try the forum.