title: htaccess file deny from all, redirects to 404 not found on 403.shtml but no custom error pages defined
body: <p>I'm setting up a quick internal project in a new addon domain in cPanel. This particular one has an SSL cert installed. I was building my .htaccess up and added a <code>&lt;Files config.php&gt;</code> directive to <code>deny from all</code> so that my config.php file isn't accessible. I realise that storing it outside of the web root is the ideal but I can't in this case.</p>
  
  <p>Normally I would expect that when going to <code>www.domain.com/config.php</code> in a browser that I would get Apache's default 403 Forbidden page. This is what happens on other domains on the same server. But in this case I'm being given a 404 not found error, stating:</p>
  
  <blockquote>
    <p>Not Found<br>
    The requested URL /403.shtml was not found on this server.<br>
    Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p>
  </blockquote>
  
  <p>I would normally expect this if I was attempting to define custom error documents but in this case, I'm not!<br>
  The only thing that makes this domain different to all the others in the same cPanel account is the fact it has an SSL certificate. And this 404 error is the same regardless of navigating using http or https. I've tried clearing cache and still the same.</p>
  
  <p>Can anyone see anything in my .htaccess below that might be causing this?</p>
  
  <pre><code>DirectoryIndex /index.php
  
  Options -Indexes +FollowSymLinks
  ServerSignature Off
  
  # PARSE PHP IN OTHER FILES
  # AddType FOR PHP AS APACHE MODULE, AddHandler FOR CGI
  AddType application/x-httpd-php .ics .xml
  
  # ATTEMPT FORCE PDF DOWNLOAD
  AddType application/octet-stream .pdf
  
  # PREVENT ACCESS TO CONFIG
  &lt;Files config.php&gt;
  order allow,deny
  deny from all
  &lt;/Files&gt;
  
  # CACHING
  # http://httpd.apache.org/docs/current/mod/mod_headers.html
  &lt;FilesMatch "\.(js|css|ico|png|gif|jpg)$"&gt;
  Header set Cache-Control "max-age=172800, public, must-revalidate"
  #Header set Expires "Thu, 15 Apr 2011 20:00:00 GMT"
  &lt;/FilesMatch&gt;
  
  # PREVENT ACCESS TO STATS UPDATE SCRIPT AS IT'S CLI ONLY
  &lt;Files stats_update.php&gt;
  order allow,deny
  deny from all
  &lt;/Files&gt;
  
  Redirect 302 /preview http://otherdomain.com/documents/preview
  Redirect 302 /sample http://otherdomain.com/documents/preview
  
  RewriteEngine On
  
  # REWRITE NON-WWW TO WWW
  RewriteCond %{HTTP_HOST} !^www\. [NC]
  RewriteRule (.*) http://www.%{HTTP_HOST}/$1 [R=301]
  
  RewriteRule ^about/?$ /index.php [L]
  RewriteRule ^contact/?$ /contact.php [L]
  RewriteRule ^home/?$ /home.php [L]
  RewriteRule ^order/?$ /order.php [L]
  
  # MAINTAINANCE
  #RewriteCond %{REMOTE_HOST} !^123\.123\.123\.123
  #RewriteCond %{REQUEST_URI} !^/maintainance\.html$
  #RewriteRule ^(.*)$ /maintainance.html [R=302,L]</code></pre>
  
  <p><strong>EDIT:</strong> Could it be anything to do with the way cPanel handles primary and addon domains?<br>
  In a cPanel account you have a primary domain whose files live under <code>public_html</code> then you define addon domains (or subdomains) whose files live under <code>public_html/addondomain.com/</code></p>
  
  <p>Would the .htaccess for the primary domain at <code>public_html/.htaccess</code> be affecting/overriding that of addon domains at <code>public_html/addondomain.com/.htaccess</code>?<br>
  I know .htaccess does cascade down through directories but is that the case even above a particular domain's DocumentRoot, e.g.: in the case of this addon domain?</p>
  
  <p><strong>EDIT 2:</strong> Just for info here are the responses to both HTTP requests, bypassing any caching</p>
  
  <pre><code>root@vps [/home/username]#curl -i 'http://www.mydomain.com/config.php'
  HTTP/1.1 403 Forbidden
  Date: Sun, 16 Sep 2012 19:05:10 GMT
  Server: Apache
  Content-Length: 331
  Content-Type: text/html; charset=iso-8859-1
  
  
  root@vps [/home/username]# curl -i 'http://mydomain.com/config.php'
  HTTP/1.1 301 Moved Permanently
  Date: Sun, 16 Sep 2012 19:05:20 GMT
  Server: Apache
  Location: http://www.mydomain.com/403.shtml
  Content-Length: 244
  Content-Type: text/html; charset=iso-8859-1
  </code></pre>
  
  <p>You see the 2nd one gets the 301 redirect but it's redirecting to the 403.shtml. So the 403.shtml has already been injected before the rewrite to the www. happens.</p>