The recommendation from the Apache project is:
In general, you should only use .htaccess files when you don't have access to the main server configuration file. ... a common misconception is that user authentication and mod_rewrite directives must go in .htaccess
files.
So please both set AllowOverride None
and all your other directives in the main httpd.conf (and/or the subsections you Include
)
When Apache is not configured with AllowOverride None
you already occur a (minor) performance penalty, regardless of wether or not any .htaccess
files are used.
This because for each and every request apache will need to check for the presence of a potential .htaccess
file in every (sub-) directory leading down to the requested resource. For example when a file is requested out of a directory /www/htdocs/example, apache must look for the following files:
/.htaccess
/www/.htaccess
/www/htdocs/.htaccess
/www/htdocs/example/.htaccess
And so, for each file access out of that directory, there are 4 additional file-system accesses, even if none of those files are present. (If AllowOveride is set for /)
The system call used for that (man 2 stat
) by itself isn't that expensive and typically the file-system cache is used rather than polling the actual disk, limiting the actual IO requirements, but still it can add up, as this article argues.
When one or more actual .htaccess
files are actually present, apache still needs to open
and read it (triggering another IO read operation and usually also an IO write operation to update the filesystem atime
attribute) and parse it before the logic therein can be applied.
Unlike when your directives are in the main httpd.conf
, which only needs apache to parse them once, at startup, each .htaccess
file needs to be interpreted again for each and every request.
How expensive, in addition to the IO operations, parsing the .htaccess files is depends on their complexity.
That will take careful benchmarking to determine.