Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a .htaccess solution against this attack - - [17/Apr/2010:15:46:49 -0500] "GET /blog/2009/04/12/shopping-cart/?cart=../../../../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1" 200 28114""Mozilla/4.0 (compatible; MSIE 7.0;Windows NT 5.1; .NET CLR 1"

my WordPress .htaccess is

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /blog/
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /blog/index.php [L]

# END WordPress
share|improve this question

First of all, don't panic. Attacks like this almost always won't work, but that's not to say you shouldn't protect against them.

If you are running your own server then look into the mod_security module, which will protect against directory traversal attacks like this as well as many other attacks. It can be a little awkward to set up and get working properly, but it's worth it.

Also make sure you are running the latest version of WordPress, plugins and themes and that your server software doesn't have any vulnerabilties.

share|improve this answer
Thanks to plugins I'm stuck to WP 2.9. I use cPanel I don't have access to Apache mods. Can this be solved with .htaccess? – Anonymous Apr 18 '10 at 11:44
There are two particularly bad vulnerabilities in WordPress 2.9.0, you really need to upgrade. There shouldn't be any plugins which work with 2.9 but don't work with 2.9.2. – kaerast Apr 18 '10 at 11:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.