Returning HTTP status 403 & 404

[Paul.J.Murphy]

I was thinking about how search engines / bots view phpBB sites, and it occurred to me that it might be better if the scripts returned 403 (Forbidden) and 404 (Not Found) responses in appropriate contexts, rather than a 200 (OK) with an information page from trigger_error() / msg_handler(). The scripts would still serve the information pages, styled as normal, but with a more accurate status code. The change would be essentially invisible to end-users, but would let browsers/caches/bots/etc know that the information page is not valid content.

Here's what I've been experimenting with, in includes/functions.php:msg_handler():

Find:

Code: Select all

                case E_USER_WARNING:
                case E_USER_NOTICE:

                        define('IN_ERROR_HANDLER', true);

                        if (empty($user->data))
                        {
                                $user->session_begin();
                        }

                        // We re-init the auth array to get correct results on login/logout
                        $auth->acl($user->data);

                        if (empty($user->lang))
                        {
                                $user->setup();
                        }

Add:

Code: Select all

                        switch ($msg_text)
                        {
                                case 'NO_ACCESS_ATTACHMENT':
                                case 'NO_AUTH_ADMIN':
                                case 'NO_AUTH_ADMIN_USER_DIFFER':
                                case 'NO_AUTH_ADMIN_OPERATION':
                                case 'NO_VIEW_USERS':
                                case 'NOT_AUTHORISED':
                                case 'SORRY_AUTH_READ':
                                        header('HTTP/1.1 403 Forbidden');
                                break;

                                case 'NO_ACTION':
                                case 'NO_FEED':
                                case 'NO_FEED_ENABLED':
                                case 'NO_FORUM':
                                case 'NO_GROUP':
                                case 'NO_MODE':
                                case 'NO_NEWER_TOPICS':
                                case 'NO_OLDER_TOPICS':
                                case 'NO_POSTS':
                                case 'NO_SITEMAP':
                                case 'NO_SITEMAP_ENABLED':
                                case 'NO_TOPIC':
                                case 'NO_USER':
                                        header('HTTP/1.1 404 Not Found');
                                break;
                        }

Those tags are not necessarily complete or 100% acccurate, just a selection I plucked from lang/en/common.php to test my theory.

What do folks think? Am I failing to see a way that this would break something?

Edit: The clever chaps at Google seem to like real 404s:
http://googlewebmastercentral.blogspot. ... -404s.html

[Dog Cow]

Not a bad idea. I issue 404's and 403's "dynamically" as well. It should make the search bots forget about those URLs after a time.