PHP - Custom error handling. Redirected 404 is being hijacked by AVG Anti-Virus. How to stop?

Question

I have a website which uses the custom 404 error handling in PHP/Apache to display specific pages.
e.g. http://metachat.org/recent

I've a feeling this is a bad way of doing this, but it's code I inherited...

Although the page displays correctly on most browsers, I'm getting a situation where AVG Anti-Virus is hijacking the page and redirecting it to an offsite 404 page.

I've tried to force a header (Status: 200 OK) using the header command in PHP, but if I do a curl -I of the page, I get the following...

HTTP/1.1 404 Not Found
Date: Fri, 03 Oct 2008 11:43:01 GMT
Server: Apache/2.0.54 (Debian GNU/Linux) DAV/2 SVN/1.1.4 PHP/4.3.10-16 mod_ssl/2
.0.54 OpenSSL/0.9.7e
X-Powered-By: PHP/4.3.10-16
Status: 200 OK
Content-Type: text/html

I guess that first line is the line AVG traps for its forced redirect. Without rewriting the software to use Mod_rewrite (which I don't really understand), how can I (in PHP) stop the "HTTP:/1/1 404 Not Found" line being sent in the headers when displaying this page?

Thanks.

Answer 1

There's no way other than using URL rewriting (mod_rewrite) or creating the missing pages. What's happening is that the client requests a page which doesn't exist. Apache is configured to serve a special page upon 404 errors, but it still sends the 404 status code, then AVG traps that.

So, you could do something like:

RewriteEngine On
RewriteCond %{REQUEST_URI} !-f
RewriteCond %{REQUEST_URI} !-d
RewriteRule (.*) index.php?missing_content=$1

That will rewrite everything that doesn't exist (and would thus give a 404) to your index.php with the URL path in the missing_content query string parameter

Answer 2

If what you get is a Page Not Found error, don't make it send Status 200 OK. Please.

It's one of most annoying "tricks" people do for whatever reason. If the page user requests does not exist, tell this to him, as well as to his browser. And to search engines, that otherwise will crawl/cache your custom error-page thinking it's the actual response.

If someone has some software installed that displays something else instead of your 404, it's his own problem and don't try to fight it making your service lie to the browser :)