Solved

htaccess and security with php

Posted on 2013-05-26
5
327 Views
Last Modified: 2013-05-26
I'm trying to improve security / reliability of our .htaccess file

Options +FollowSymlinks
ErrorDocument 404 http://www.website.com
ErrorDocument 403 http://www.website.com
Options -Indexes


RewriteEngine on
RewriteCond %{HTTP_HOST} !^www\.website\.com$ [NC]
RewriteRule ^(.*)$ http://www.website.com/$1 [L,R=301]

Can you suggest security statements to prevent this file being hacked

or ensure that get/post requests were only handled by the server ip address

Or any other statements that would help secure the site ?
0
Comment
Question by:joomla
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 83

Expert Comment

by:Dave Baldwin
ID: 39198303
If your Apache web server is configured correctly, '.htaccess' files can not be accessed or hacked from the web.  If someone breaks into the server as an authorized user, they might be able to make changes then.  

'get/post requests' normally have to be handled by the page they are sent to because it will have the code to process the information.  There is no generic way to handle those.  Sending the info to the server IP address only works if the target is the directory index which in this case should be 'index.php'.

Sending people to the index page of your web site for a 404 error is not very friendly or informative.
0
 

Author Comment

by:joomla
ID: 39198308
Can you tell me what these setting are intended to do ?



IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti*

<Limit GET POST>
order deny,allow
deny from all
allow from all
</Limit>
<Limit PUT DELETE>
order deny,allow
deny from all
</Limit>
0
 
LVL 83

Expert Comment

by:Dave Baldwin
ID: 39198324
indexignore  http://httpd.apache.org/docs/current/mod/mod_autoindex.html#indexignore

According to one site, the <Limit GET POST> section is not correct.  The <Limit PUT DELETE> is probably not necessary because Apache does not provide handlers for those functions.
0
 

Author Comment

by:joomla
ID: 39198332
thanks for your help and clarifying my questions.

from my understanding of what you have said, there are no additional security options you can suggest to make the site more secure.

regards
Michael
0
 
LVL 83

Accepted Solution

by:
Dave Baldwin earned 250 total points
ID: 39198375
Not with .htaccess.  There are things like blocking unwanted visitors but that tends to end up with long lists that take time for the server to go thru before your page is delivered.  You don't want to do that unless it is really necessary.

If you really are doing this for a Joomla site,  do a search for 'Joomla htaccess' and you'll find all kinds of different suggestions.  In general though, you want to put as little in .htaccess as you can because every single request has to be filtered by it.
0

Featured Post

Create the perfect environment for any meeting

You might have a modern environment with all sorts of high-tech equipment, but what makes it worthwhile is how you seamlessly bring together the presentation with audio, video and lighting. The ATEN Control System provides integrated control and system automation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you are running a LAMP infrastructure, this little code snippet is very helpful if you are serving lots of HTML, JavaScript and CSS-related information. The mod_deflate module, which is part of the Apache 2.2 application, provides the DEFLATE…
Over the last year I have answered a couple of basic URL rewriting questions several times so I thought I might as well have a stab at: explaining the basics, providing a few useful links and consolidating some of the most common queries into a sing…
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…

624 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question