Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

htaccess and security with php

Posted on 2013-05-26
5
Medium Priority
?
329 Views
Last Modified: 2013-05-26
I'm trying to improve security / reliability of our .htaccess file

Options +FollowSymlinks
ErrorDocument 404 http://www.website.com
ErrorDocument 403 http://www.website.com
Options -Indexes


RewriteEngine on
RewriteCond %{HTTP_HOST} !^www\.website\.com$ [NC]
RewriteRule ^(.*)$ http://www.website.com/$1 [L,R=301]

Can you suggest security statements to prevent this file being hacked

or ensure that get/post requests were only handled by the server ip address

Or any other statements that would help secure the site ?
0
Comment
Question by:joomla
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 84

Expert Comment

by:Dave Baldwin
ID: 39198303
If your Apache web server is configured correctly, '.htaccess' files can not be accessed or hacked from the web.  If someone breaks into the server as an authorized user, they might be able to make changes then.  

'get/post requests' normally have to be handled by the page they are sent to because it will have the code to process the information.  There is no generic way to handle those.  Sending the info to the server IP address only works if the target is the directory index which in this case should be 'index.php'.

Sending people to the index page of your web site for a 404 error is not very friendly or informative.
0
 

Author Comment

by:joomla
ID: 39198308
Can you tell me what these setting are intended to do ?



IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti*

<Limit GET POST>
order deny,allow
deny from all
allow from all
</Limit>
<Limit PUT DELETE>
order deny,allow
deny from all
</Limit>
0
 
LVL 84

Expert Comment

by:Dave Baldwin
ID: 39198324
indexignore  http://httpd.apache.org/docs/current/mod/mod_autoindex.html#indexignore

According to one site, the <Limit GET POST> section is not correct.  The <Limit PUT DELETE> is probably not necessary because Apache does not provide handlers for those functions.
0
 

Author Comment

by:joomla
ID: 39198332
thanks for your help and clarifying my questions.

from my understanding of what you have said, there are no additional security options you can suggest to make the site more secure.

regards
Michael
0
 
LVL 84

Accepted Solution

by:
Dave Baldwin earned 1000 total points
ID: 39198375
Not with .htaccess.  There are things like blocking unwanted visitors but that tends to end up with long lists that take time for the server to go thru before your page is delivered.  You don't want to do that unless it is really necessary.

If you really are doing this for a Joomla site,  do a search for 'Joomla htaccess' and you'll find all kinds of different suggestions.  In general though, you want to put as little in .htaccess as you can because every single request has to be filtered by it.
0

Featured Post

Use Case: Protecting a Hybrid Cloud Infrastructure

Microsoft Azure is rapidly becoming the norm in dynamic IT environments. This document describes the challenges that organizations face when protecting data in a hybrid cloud IT environment and presents a use case to demonstrate how Acronis Backup protects all data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

As Wikipedia explains 'robots.txt' as -- the robot exclusion standard, also known as the Robots Exclusion Protocol or robots.txt protocol, is a convention to prevent cooperating web spiders and other web robots from accessing all or part of a websit…
If your site has a few sections that need to be secure when data is transmitted between the server and local computer, such as a /order/ section for ordering or /customer/ which contains customer data, etc it would of course be recommended to secure…
Add bar graphs to Access queries using Unicode block characters. Graphs appear on every record in the color you want. Give life to numbers. Hopes this gives you ideas on visualizing your data in new ways ~ Create a calculated field in a query: …
In response to a need for security and privacy, and to continue fostering an environment members can turn to for support, solutions, and education, Experts Exchange has created anonymous question capabilities. This new feature is available to our Pr…
Suggested Courses

715 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question