htaccess-file
The name of the file is .htaccess (Its the extention with no name). A .htaccess-file is a files that lets you do a whole lot off security tricks:
You can't create .files in windows (You can, but its hard). Give them another name and rename them on the server.
- Custom error pages
- Preventing a directory from being listed
- Password protection
- Deny users by IP
- Change your default directory page
- Prevent viewing of .htaccess file
- Redirects
- Adding MIME types
- Preventing hot linking of your images
You can write .htaccess in notepad (or any other simple-text editor). Remember to turn off wordwrap.
If you are using Microsoft FrontPage extensions you shouldn't edit the .htaccess -document.
.htaccess files must be uploaded as ASCII mode, NOT BINARY.Custom error pages
Below is a list of the server returned error codes that are most seen by users.
Error document codes (most used) 400 Bad Request 401 Authorization Required 403 Forbidden 404 Not Found 500 Internal Server Error 400 - Bad Request, which is one of those generic kind of errors that people get to by doing some weird stuff with your URL or scripts.
401 - Authorization Required (as in when somebody tries to enter a protected area of your site without the proper credentials)
403 - Forbidden (as in when a file with permissions not allowing it to be accessed by the user is requested)
404 - Handle requests for pages that are not found.
500 - Internal server errors in any scripts you have currently running.In order to specify your own customized error documents, you simply need to add the following commands, on one line, within your htaccess file:
You can name the pages anything you want and you can place the error pages anywhere you want within your site, so long as they are web-accessible (through a URL). The initial slash in the directory location represents the root directory of your site, that being where your default page for your first-level domain is located.ErrorDocument 404 /errors/notfound.htmlYou can specify a full URL rather than a virtual URL in the ErrorDocument string (http://yoursite.com/errors/notfound.html vs. /errors/notfound.html). But this may not be the preferred method by the server's happiness standards.
You can also specify HTML with your error documents.
ErrorDocument 401 "<body bgcolor=#ffffff><h1> You have to actually <b>BE</b> a <a href="#">member</A> to view this page!</h1></body>"Preventing a directory from being listed
Do you have a directory full of images or zips that you do not want people to be able to browse through? Typically a server is setup to prevent directory listing, but sometimes they are not. If your server is not, you will have to become self-sufficient and fix the problem with htaccess:
The * is a wildcard that matches all filesIndexIgnore *
Place that line into an htaccess file in your images directory and nothing in that directory will be able to be listed.What if you wanted the directory contents to be listed, but only the HTML pages and not the images?
This would return a list of all the files except those specified in the above example.IndexIgnore *.gif *.jpgIf your server is setup to prevent directory listing and you want your directories to be listed then you could simply put this into the htaccess file:
If you do use this option, be very careful that you do not put any unintentional or compromising files in this directory. You can put in a minus sign (Options -Indexes) to prevent directory listing entirely. This is typical of most server setups and is usually configured elsewhere in the Apache server, but can be overridden through the use of htaccess.Options +IndexesPassword protection
There are numerous methods to password protecting areas of your site with some server language based (such as ASP, PHP or PERL) and client side based, such as JavaScript. JavaScript is not as secure or foolproof as a server-side option. A server side challenge/response is always more secure than a client dependant challenge/response. Htaccess is about as secure as you can or need to get in everyday life.
The first thing you will need to do is create a file called .htpasswd. I know, you might have problems with the naming convention, but it is the same idea behind naming the .htaccess file itself, and you should be able to do that by this point. In the .htpasswd file, you place the username and password (which is encrypted) for those whom you want to have access.
Example:
There is a handy tool to easily encrypt the password at http://www.euronet.nl/~arnow/htpasswd/username:encryptedpassFor security, you should not upload the htpasswd file to a directory that is web accessible (yoursite.com/.htpasswd), it should be placed above your www root directory. You'll be specifying the location to it later on, so be sure you know where you put it. Also, this file, as with htaccess, should be uploaded as ASCII and not BINARY.
Create a new htaccess file and place the following code in it:
The first line is the full server path to your htpasswd file. If you have installed scripts on your server, you should be familiar with this. Please note that this is not a URL, this is a server path. Also note that if you place this htaccess file in your root directory, it will password protect your entire site, which probably isn't your exact goal.The second to last line require user is where you enter the username of those who you want to have access to that portion of your site. Note that using this will allow only that specific user to be able to access that directory. This applies if you had an htpasswd file that had multiple users setup in it and you wanted each one to have access to an individual directory. If you wanted the entire list of users to have access to that directory, you would replace Require user xxx with require valid-user.
The AuthName is the name of the area you want to access. It could anything, such as "EnterPassword". You can change the name of this 'realm' to whatever you want, within reason.
We are using AuthType Basic because we are using basic HTTP authentication.
Deny users by IP
Add the following to the .htaccess file:
This is an example of a .htaccess file that will block access to your site to anyone who is coming from any IP address beginning with 128.23.45 and from the specific IP address 207.158.255.213 . By specifying only part of an IP address, and ending the partial IP address with a period, all sub-addresses coming from the specified IP address block will be blocked. You must use the IP addresses to block access, use of domain names is not supported. To deny all IP addresses from your site use:Change your default directory page
Some of you may be wondering what is DirectoryIndex? It is a command which allows you to specify a file that is to be loaded as your default page whenever a directory or url request comes in, that does not specify a specific page.
This would cause filename.html to be treated as your default page, or default directory page. You can also append other filenames to it. You may want to have certain directories use a script as a default page.DirectoryIndex filename.htmlPlacing the above command in your htaccess file will cause this to happen:DirectoryIndex filename.html index.cgi index.pl default.htm
When a user types in yoursite.com, your site will look for filename.html in your root directory (or any directory if you specify this in the global htaccess), and if it finds it, it will load that page as the default page. If it does not find filename.html, it will then look for index.cgi; if it finds that one, it will load it, if not, it will look for index.pl and the whole process repeats until it finds a file it can use. Basically, the list of files is read from left to right.Prevent viewing of .htaccess file
If you use htaccess for password protection, then the location containing all of your password information is plainly available through the htaccess file. If you have set incorrect permissions or if your server is not as secure as it could be, a browser has the potential to view an htaccess file through a standard web interface and thus compromise your site/server. This, of course, would be a bad thing. However, it is possible to prevent an htaccess file from being viewed in this manner:
The first line specifies that the file named .htaccess is having this rule applied to it. You could use this for other purposes as well if you get creative enough. If you use this in your htaccess file, a person trying to see that file would get returned (under most server configurations) a 403 error code. You can also set permissions for your htaccess file via CHMOD, which would also prevent this from happening, as an added measure of security: 644 or RW-R--R--The first thing you will need to do is create a file called .htpasswd. I know, you might have problems with the naming convention, but it is the same idea behind naming the .htaccess file itself, and you should be able to do that by this point. In the .htpasswd file, you place the username and password (which is encrypted) for those whom you want to have access.
Example:
There is a handy tool to easily encrypt the password at http://www.euronet.nl/~arnow/htpasswd/username:encryptedpassFor security, you should not upload the htpasswd file to a directory that is web accessible (yoursite.com/.htpasswd), it should be placed above your www root directory. You'll be specifying the location to it later on, so be sure you know where you put it. Also, this file, as with htaccess, should be uploaded as ASCII and not BINARY.
Create a new htaccess file and place the following code in it:
The first line is the full server path to your htpasswd file. If you have installed scripts on your server, you should be familiar with this. Please note that this is not a URL, this is a server path. Also note that if you place this htaccess file in your root directory, it will password protect your entire site, which probably isn't your exact goal.The second to last line require user is where you enter the username of those who you want to have access to that portion of your site. Note that using this will allow only that specific user to be able to access that directory. This applies if you had an htpasswd file that had multiple users setup in it and you wanted each one to have access to an individual directory. If you wanted the entire list of users to have access to that directory, you would replace Require user xxx with require valid-user.
The AuthName is the name of the area you want to access. It could anything, such as "EnterPassword". You can change the name of this 'realm' to whatever you want, within reason.
We are using AuthType Basic because we are using basic HTTP authentication.
Redirects
Ever go through the nightmare of changing significantly portions of your site, then having to deal with the problem of people finding their way from the old pages to the new? There are different ways of redirecting pages, through http-equiv, javascript or any of the server-side languages. You can do it through htaccess, which is probably the most effective, considering the minimal amount of work required to do it.
Htaccess uses redirect to look for any request for a specific page and if it finds that request, it forwards it to a new page you have specified:
Note that there are 3 parts to that, which should all be on one line.The redirect command.
The location of the file/directory you want redirected relative to the root of your site (/olddirectory/oldfile.html = yoursite.com/olddirectory/oldfile.html) The full URL of the location you want that request sent to.Each of the 3 is separated by a single space, but all on one line. You can also redirect an entire directory by simple using:
Using this method, you can redirect any number of pages no matter what you do to your directory structure. It is the fastest method as a global affect.Redirect /olddirectory/ http://yoursite.com/newdirectory/Adding MIME Types
What are MIME Types?
MIME stands for Multipurpose Internet Mail Extensions. It extends the power of web browsers to handle graphics, sound and multimedia. MIME is also used for binary email attachments. Browsers recognize MIME types in categories and file types, separated by a slash (such as image/gif). If you've registered a MIME type, the browser decodes the file and launches a helper application. What if your server wasn't set up to deliver certain file types properly? A common occurrence with MP3 or even SWF files. Simple enough to fix with htaccess:
To do this you must first understand the three parts of adding a MIMI type. The first part is the AddType. This tells the server that you are adding a MIME type. Second is the application string. This is the actual parameter of the MIME you are adding (the MIME type). The final part is the default extension for the MIME type you want to add.
AddType mime-type .ext
Save the .htaccess file and store all ext files in the same directory. Then, all files in the directory that end in .ext (those extensions you have added) will be mapped into mime-type and handled properly by the server. Please note that you must include a period (.) before the extension. You can list several extensions separated by blanks. For example, if you wanted to store and serve Lotus 1-2-3 files with the extensions wks, wk1, wk2, wk3, and wk4, you should type:
By the way, here's a neat little trick that few know about. To force a file to be downloaded, via the Save As browser feature, you can simply set a MIME type to application/octet-stream and that immediately prompts you for the download.AddType application/lotus123 .wks .wk1 .wk2 .wk3 .wk4Preventing hot linking of images
In the webmaster community, "hot linking" is a curse phrase. Also known as "bandwidth stealing". It refers to linking directly to non-html objects not on one own's server, such as images, .js files etc. The victim's server in this case is robbed of bandwidth (and in turn money) as the violator enjoys showing content without having to pay for its deliverance. The most common practice of hot linking pertains to another site's images.
In the webmaster community, "hot linking" is a curse phrase. Also known as "bandwidth stealing". It refers to linking directly to non-html objects not on one own's server, such as images, .js files etc. The victim's server in this case is robbed of bandwidth (and in turn money) as the violator enjoys showing content without having to pay for its deliverance. The most common practice of hot linking pertains to another site's images.
The best way to stop hot linking is to have your images be placed in a separate folder (not the same folder as html files) and put a .htaccess file in it.
Copy this text below, make the changes to show your domain info, and paste it into notepad. Name this file .htaccess and place in in all your images folders. Be sure to upload in ASCII mode or the .htaccess file will not work.
Be sure to replace "mydomain.com" with your own. The above code causes a broken image to be displayed when its hot linked. You can have an image display for those who try to hot link. You can have an image of your choice be displayed for those attempting to steal bandwidth. The code for this is:RewriteEngine on RewriteCond %{HTTP_REFERER} !^$ RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain.com/.*$ [NC] RewriteRule \.(gif|jpg)$ - [F]The first line tells Apache to turn on the MOD Rewrite.RewriteEngine on RewriteCond %{HTTP_REFERER} !^$ RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain.com/.*$ [NC] RewriteRule \.(gif|jpg)$ http://www.mydomain.com/notallowed.gif [R,L]
The next two lines you change to your address (either with, and without the www. as well as your IP).
The last line is where you would like the link from the site trying to download from their pages to be redirected. This way if some one links directly to your "coolpicture.jpg" from their website, instead of seeing your cool picture the user will see a picture that you decide to show. Make the picture be something the user will not want to see and get the message across that he is a bandwidth stealer. After the user sees that the "hot linking" isn't working, the user will change his links.In order to have it work for you:
replace mydomain.com with your own domain
replace the notallowed.gif with the image you want them to see.
In cooperation with SecurityHome.eu
