Code Bytes
Return a proper 503 maintenance page with Apache
Show a self-contained maintenance page with the correct HTTP status and retry guidance, without redirecting every visitor to a misleading success page.
A maintenance message should say “temporarily unavailable” to browsers and crawlers alike. Rewriting everything to a page that returns 200 OK hides the outage instead of describing it.
A small, reversible maintenance rule
Create a self-contained /maintenance.html first. It should not need the CMS, a database or external fonts to explain that the site will be back shortly.
On Apache 2.4 with mod_rewrite and mod_headers, place this above the normal rules in the site's root .htaccess:
ErrorDocument 503 /maintenance.html
RewriteEngine On
RewriteCond %{REQUEST_URI} !^/maintenance\.html$
RewriteRule ^ - [R=503,L]
Header always set Retry-After "3600" "expr=%{REQUEST_STATUS} == 503"
Header always set Cache-Control "no-store" "expr=%{REQUEST_STATUS} == 503"
The error document is an internal local path, not an external redirect. The original request keeps its 503 status while Apache serves the maintenance document. Retry-After: 3600 suggests checking again in an hour; use an honest interval.
Decide what must remain operational
This rule deliberately blocks the whole application. Do not use it blindly on a site receiving payment webhooks, external callbacks or other time-sensitive requests. Those routes need a separately reviewed continuity plan, not a guess at an exception list.
For private work during maintenance, prefer an authenticated preview or secured origin. An IP exception is brittle behind reverse proxies and is not a substitute for authentication. Never trust a visitor-supplied forwarded-IP header to bypass maintenance or access controls.
Request an ordinary page and confirm 503, the branded document and Retry-After. Remove the maintenance block when finished, then verify normal responses and clear any intermediary cache that ignored the policy. Nginx and edge platforms require their own configuration.
References: Apache custom error responses and conditional response headers.
Original version7 May 2014
Kept here for reference and earlier links. The updated guide above is the recommended starting point; older code may depend on retired services or different software versions.
Many times you will want to temporarily put your site into a locked down and/or maintenance mode. This can be for a multitude of reasons, testing a brand new feature for the first time on the live server, upgrading software, migrating databases etc.
The below should be placed in your apache .htaccess file at the very top, and removed again when maintenance mode is over.
Simply add your own IP (can add multiple IPs via the separate lines as demonstrated) into the RewriteCond lines for IP and you will still be able to access and see the site, however, everyone else will just be rewritten to /maintenance.php
RewriteEngine On
RewriteBase /
#Add your IPs below, keeping the backslashes, to enable full access to site
RewriteCond %{REMOTE_ADDR} !^255\.255\.255\.255$
RewriteCond %{REMOTE_ADDR} !^100\.123\.123\.123$
#Route any request to the maintenance page if IP condition not met ...
RewriteCond %{REQUEST_URI} !^/maintenance\.php$
#Rewrite to maintenance.php if IP condition not met
RewriteRule ^(.*)$ /maintenance.php [L]
Keep exploring