Use your web server to map an extensionless address such as /about to about.php. PHP does not remove the filename from the browser’s address bar itself: Apache uses mod_rewrite, while Nginx uses server configuration such as try_files and PHP-FPM handling. Update your links to the clean paths, then decide how old .php addresses should behave.
What “hiding .php” actually means
A clean URL is normally an internal rewrite, not a renamed file. The browser requests /about; the server resolves that request to about.php and returns its response while leaving /about in the address bar. This routing belongs to the web server or application router, not to PHP code running after the request has already been mapped.
There are two separate URL operations:
- Internal rewrite: maps
/abouttoabout.phpwithout changing the visible URL. - External redirect: sends the browser from an old address such as
/about.phpto/about, changing the visible URL and creating one canonical address.
Choose configuration for the server that actually handles the request. Apache .htaccess rules do not work in Nginx, and Nginx directives cannot be pasted into an Apache file.
Choose the routing approach
| Approach | Best fit | Configuration location | Important checks |
|---|---|---|---|
Apache mod_rewrite |
Apache hosting where rewrite permissions are enabled | .htaccess or virtual-host/server configuration |
AllowOverride, existing rules, document root, subdirectories or aliases, and rewrite loops |
Nginx try_files plus PHP handling |
Nginx hosting with access to server configuration | Nginx server/location blocks |
root or alias, candidate order, PHP-FPM socket or upstream, and location precedence |
| Application front controller | Frameworks or sites that route requests through one entry script | Web-server fallback plus the application router | Static-file bypass, path and query forwarding, and framework route definitions |
Apache’s per-directory rewrite guide is at httpd.apache.org/docs/trunk/rewrite/htaccess.html. Nginx documents try_files and related URI processing at nginx.org/en/docs/http/ngx_http_core_module.html.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →#1 Best Overall
Apache: map clean paths to matching PHP files
Before you add rules
- Confirm the site is served by Apache and that
mod_rewriteis loaded. - Check that the host permits overrides if you are using
.htaccess; anAllowOverridepolicy can make the file ineffective. - Identify the real document root. A subdirectory, symlink, or
Aliascan change how paths are interpreted.
Illustrative per-directory pattern
For a simple site in its document root, a pattern like the following can internally map a single path segment to a same-named PHP file:
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{DOCUMENT_ROOT}/$1.php -f
RewriteRule ^([^./]+?)/?$ $1.php [L]This is a pattern to adapt, not a universal copy-and-paste solution. The condition using DOCUMENT_ROOT may need to change for a subdirectory or alias, and existing rewrite rules may require a different order. The !-f and !-d guards preserve real files and directories such as CSS, images, uploads, and asset folders before the PHP fallback runs.
Rank #2
If every unmatched route belongs to one application entry point, use a front-controller design instead: let the server bypass existing files and directories, then send the remaining request to index.php. The application router must then interpret the path and query string.
Why rewrite rules can loop
Apache can process URL mapping in more than one round. Guards that exclude existing files and directories, together with a terminating flag such as [L], help prevent an internal rewrite from being applied repeatedly. Review the deployed Apache version and the flag reference at httpd.apache.org/docs/2.4/rewrite/flags.html. The cited per-directory guide is from Apache’s trunk documentation series, so use documentation matching your installed version when syntax or behavior differs.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Nginx: use try_files and PHP-FPM configuration
Nginx does not read .htaccess. Add the routing to the appropriate server or location configuration, then reload Nginx after validating the configuration.
Candidate order
A typical idea is to test the requested URI, then a directory, then a same-named PHP script:
Rank #4
location / {
try_files $uri $uri/ $uri.php?$query_string;
}Adapt this to the site’s actual root or alias, existing locations, and front-controller policy. The PHP location must pass a valid script filename to the configured FastCGI backend (usually PHP-FPM); a rewrite alone does not execute PHP.
For example, a request for /about should resolve to the file beneath the configured document root, while a request for an existing image or directory should remain untouched. If the site uses one entry script, the final try_files fallback should be that application URI rather than $uri.php. Nginx’s core-module documentation explains candidate checks and internal redirects at nginx.org/en/docs/http/ngx_http_core_module.html.
Make the clean URL the site’s canonical address
Change internal links
Use /about in navigation, templates, sitemaps, and content instead of /about.php. A rewrite does not automatically change links that your application emits.
Handle legacy .php requests deliberately
If both /about.php and /about remain reachable, search engines and users can see two addresses for one document. You may keep the old path, redirect it externally to /about, or reject it, depending on compatibility requirements. If you redirect, preserve legitimate query parameters and ensure the rule cannot redirect the clean URL back to itself. Apache’s redirect and rewrite flags are documented at httpd.apache.org/docs/2.4/rewrite/flags.html.
Review canonical metadata
Where the site uses canonical tags or generated URLs, make them point to the chosen extensionless address. This is separate from the server rewrite and must be handled by the application or template system.
Test the routing before putting it live
- Identify whether the origin is Apache, Nginx, a managed proxy, or a combination, and confirm you can edit the relevant configuration.
- Verify that the intended PHP file exists under the configured document root and that PHP execution already works.
- Request the clean path, such as
/about. Confirm the expected page is returned and the browser address remains extensionless. - Test a query string, for example
/about?ref=home, and confirm the application receives the parameter. - Test nested paths, trailing-slash variants, static files, real directories, and a nonexistent path.
- Request the old
.phpURL and verify the policy you selected: retained, redirected, or blocked. - Inspect web-server and PHP/FastCGI logs for rewrite, permission, and script-filename errors.
- Update internal links and canonical tags after the server behavior is correct.
Common failures and their causes
- 404 on every clean path: the rule is not being loaded, the file is outside the document root, or the server is not the stack you configured.
- PHP source appears as text or downloads: PHP handling is not configured correctly; URL rewriting does not replace PHP-FPM or the server’s PHP module.
- Images and styles break: a catch-all rule is capturing existing files. Restore the
!-f/!-dguards in Apache or the correct candidate order in Nginx. - Redirect loop: an external redirect is also matching the already-clean path, or multiple rewrite layers are fighting each other.
- Works at the root but not in a subfolder: the rewrite base, document root,
Alias, or Nginxroot/aliasdoes not match the URL layout.
Clean URLs are not a security control
Removing .php can reduce visible implementation detail, but it does not protect source code, sessions, database queries, or administrative paths. The PHP manual states, “In general, security by obscurity is one of the weakest forms of security.” Use secure coding, timely patching, access control, safe file permissions, and correct server configuration regardless of whether extensions are visible: php.net/manual/en/security.hiding.php.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
