17

When you create a page in WordPress, it's just an entry in a database table; there's no actual file at that location. However I can create a file at that location myself and it will steal the page away from WordPress. I delete the file and it seamlessly goes back to the WordPress page.

I'm just curious about how this is achieved. Presumably some communication is happening between WordPress and Apache(?).

27

Actually there is no communication happening between Apache and WordPress. The "magic" is happening in Apache mod_rewrite rules.

For a standard WordPress installation, you have the following rules in .htaccess:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

Notice this line: RewriteRule . /index.php [L] Here, we are telling Apache to internally redirect any URL request to /index.php.

Unless: this line: RewriteCond %{REQUEST_FILENAME} !-f becomes false. That means, with adding this RewriteCond with the above RewriteRule, we are telling Apache to send all requests to /index.php, but not if it's an existing file.

Also, when this line: RewriteCond %{REQUEST_FILENAME} !-d becomes false. That means, with adding this RewriteCond with the above RewriteRule, we are telling Apache to send all request to /index.php, but not if it's an existing directory.

So in the end, unless it's an existing file or an existing directory, Apache is internally sending all other requests to /index.php.

So as you see, no communication is happening between Apache & WordPress. Apache is deciding everything itself and we are telling it to do so using RewriteRule and RewriteCond directives.

Read more about mod_rewrite HERE.

  • 3
    This is great. I understand perfectly. I've looked at the default .htaccess file many times and never bothered to analyse it. Thank you! – Matt Feb 18 '17 at 14:26
  • This is a design pattern called front controller. Note that it redirects all non-existing urls to index.php, this means that if you type out the full path to your functions.php file, the frontcontroller won't work and the website will serve functions.php. This is why you'll often see WordPress plugin and theme files start with if ( !defined(‘ABSPATH’)) exit; – Sjors Ottjes Feb 19 '17 at 16:41
  • Yes I have seen that in plugins but did not understand its purpose. So, if !defined(‘ABSPATH’) evaluates to true, it means something other than WordPress is trying to access the script (because ABSPATH is defined in wp-config.php), and therefore it should ignore that request. Is that correct? – Matt Feb 19 '17 at 16:52
  • @matt That's correct. Although I'd not say that "something other than WordPress". Because you can define ABSPATH in any other PHP script as well, so it'll allow other scripts on your own server. What it'll not allow is the direct access of that file from outside of your server (say from browser). Because by accessing that file directly, users are in no way able to define ABSPATH. – Fayaz Feb 19 '17 at 16:56
  • This is really great to know. I constantly worry about security and I'll be able to take advantage of this right away. Thank you! – Matt Feb 19 '17 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.