A number of different things:
Don’t use .htaccess
files
There are numerous well-intended examples of code in .htaccess
files that then get copied again and again by/for cargo cult system administrators that should be reading the actual manual instead.
From: https://httpd.apache.org/docs/2.4/howto/htaccess.html
In general, you should only use .htaccess
files when you don't have access to the main server configuration file. There is, for example, a common misconception that user authentication should always be done in .htaccess files, and, in more recent years, another misconception that mod_rewrite directives must go in .htaccess
files. This is simply not the case.
...
In the case of RewriteRule directives, in .htaccess
context these regular expressions must be re-compiled with every request to the directory, whereas in main server configuration context they are compiled once and cached. Additionally, the rules themselves are more complicated, as one must work around the restrictions that come with per-directory context and mod_rewrite. Consult the Rewrite Guide for more detail on this subject.
Second:
You mentioned a couple of directory names already that should be excluded from the example.com/[user-alias]
mapping.
Don’t forget to also prohibit people from intentionally selecting those directory (and other) names as their user-alias as well in your sign up page.
Last
RewriteCond
directives are used to restrict the types of requests that will be subject to the following RewriteRule
.
Your config currently says, in "plain" English, don’t apply the following RewriteRule
when there is an existing file or directory with the same name as the file name component from the request.
You simply can add extra conditionals to that with extra RewriteCond
lines, for example:
RewriteCond %{REQUEST_FILENAME} !"login"
should exclude example.com/login