How do you write correct and safe mod_rewrite rules?

Most rewrite bugs come from context and ordering. In directory context the leading slash is already removed, so a pattern written for vhost context will not match. Rules are processed repeatedly after internal rewrites, so an unanchored pattern can keep matching its own output and loop until Apache returns 500.

RewriteEngine On
RewriteBase /

RewriteRule ^old/(.*)$ /new/$1 [R=301,L]

RewriteCond %{QUERY_STRING} ^page=([0-9]+)$
RewriteRule ^article$ /articles/%1? [R=301,L]

RewriteRule ^api/(.*)$ http://127.0.0.1:8080/api/$1 [P,L]

Flags that matter

• L stops the current round; END stops all rewriting for the request
• R=301 or R=302 sends an external redirect, changing the URL the client sees
• P proxies the request through mod_proxy instead of redirecting
• QSA appends the original query string; a trailing ? in the substitution discards it
• NC makes matching case-insensitive; use it only when the URL space is truly case-insensitive
• NE prevents escaping of special characters in the output, which is risky unless intentional

Safety practices

Order specific rules before general ones. Use filesystem conditions such as !-f and !-d only when they express the real intent. Bound capture groups and avoid patterns that match everything. For host or scheme redirects, validate the Host header against an allowlist instead of reflecting it blindly into a Location header.