Temporary maintenance page with .htaccess

You can put a site into temporary maintenance with .htaccess and keep every URL with a 503 Service Unavailable response. This tells visitors the outage is temporary without redirecting every page to a different address.

Prepare the page

Create a static mantenimiento.html file in the domain's public root. That way it does not depend on PHP or on the database you are repairing. If it uses its own images or CSS, put them in mantenimiento-assets or use styles inside the HTML.

Keep the original .htaccess and add this block before the CMS's general rules:

ErrorDocument 503 /mantenimiento.html

RewriteEngine On
RewriteCond %{HTTP_HOST} ^(www\.)?example\.com$ [NC]
RewriteCond %{REMOTE_ADDR} !^192\.0\.2\.10$
RewriteCond %{REQUEST_URI} !^/mantenimiento\.html$ [NC]
RewriteCond %{REQUEST_URI} !^/mantenimiento-assets/ [NC]
RewriteCond %{REQUEST_URI} !^/robots\.txt$ [NC]
RewriteRule ^ - [R=503,L]

Replace example.com with your domain, keeping the dots escaped, and 192.0.2.10 with the public IP authorised to keep working. These are example values. If you need to cover other names, widen the scope explicitly.

The maintenance page, its resources and robots.txt stay accessible. Everything else returns 503 except for the authorised IP. If the site is served from a subfolder, also adapt the paths of the exceptions and of the error document.

Check and finish

Test from a connection other than the authorised one: the home page and an internal URL must return 503 and show the page. Also check that its resources load and that you can keep working from your connection.

If there is a server or CDN cache, check the response a visitor sees; a stored copy can hide the maintenance or linger afterwards. Do not publish the maintenance page as a 200 response for every URL.

When you finish, remove this block, restore the usual rules and check the affected pages, forms and HTTP status. Keep maintenance on only for as long as you need it.

If you use a proxy

REMOTE_ADDR may contain the proxy's IP instead of yours. Confirm how the server recognises trusted proxy IPs before using this exception; do not replace the condition with a header the visitor could forge.

If you cannot reliably identify your connection, use the application's maintenance mode with authenticated access or agree another approach with support. Do not turn off the proxy just to make an IP match.