5
votes
1answer
94 views

How to minimise effect of mischievous, persistent POST requests

For a few months now one of our shared hosting servers has been persistently and constantly hammered by "POST /" requests from what must be hundreds of thousands of individual IPs. On a number of ...
0
votes
1answer
341 views

How can I setup an IP whitelist for a subdirectory?

A client of mine complained of an attack. I checked the access log and found a massive number of requests for the admin login page from seemingly random IP addresses. I created an .htacces file in the ...
0
votes
1answer
91 views

How to specify Multiple Secure Webpages with .htaccess RewriteCond

I have 3 pages that I want to make secure on my website using .htaccess -login.php -checkout.php -account.php I know how to make just one work page at a time using .htaccess RewriteEngine On ...
0
votes
1answer
119 views

.htaccess password directory protection - blank page

i want to use for some website Apache password protection for an directory. This is not mine hosting so I can't look to logs or sth. So I just copied my .htacces that works just perfect on my hosting. ...
-3
votes
1answer
119 views

Protecting a chmodded 0777 cache directory?

A website I'm developing requires several directories to have their permissions set to 0777. The directories are used as cache directories for HTML and PHP files generated by the website. The ...
-3
votes
1answer
119 views

.htaccess user agents and website security [closed]

I have been looking around and trying to work out the best way to protect a few websites of mine. Appart from the obvious manual monitoring of the site logs and banning extreme/suspicious activity. I ...
0
votes
2answers
66 views

Securing a directory using htaccess but with different levels of access

I am trying to secure a directory by IP address. I need to access the directory from my ip address (through the browser) and no one else. But I also need to access it via cron (cli). I also have ...
1
vote
2answers
98 views

Apache htaccess reliability

I am denying access to certain files in the public_html folder with <Files ~ "\.inc$"> Order allow,deny Deny from all </Files> place in a .htaccess file. I know it is best to ...
1
vote
2answers
171 views

Weird htaccess problem and php denying internal requests

I have added Order Deny,Allow Deny from all allow from *my ip* to my htaccess file but now when I use a function like getimagesize, I get an error while trying to retrieve the data from a local ...
1
vote
1answer
581 views

Apache: disable directory listings

I'm using Apache 2.2. In the var/www directory I've created a .htaccess file that contains this: Options -indexes When I reach my site and want to see the directories and files like this: ...
0
votes
2answers
576 views

.htaccess htpassword protect, safe enough?

I'm blocking my site via .htaccess, htpassword. I heard from a friend that it's really a joke and it can be bypassed in a minute. Is that true? What are other methods that I can use to prevent ...
1
vote
2answers
97 views

Protecting PHP packages on server

I am a php developer and have recently decided to make one of my Magento extensions commercial. I have downloaded and configured MageParts CEM Server and that is all working perfectly in regard to ...
5
votes
2answers
656 views

Finding Webserver Vulnerability

We operate a webserver farm hosting around 300 websites. Yesterday morning a script placed .htaccess files owned by www-data (the apache user) in every directory under the document_root of most (but ...
1
vote
1answer
215 views

Regular expression not working in .htaccess

I'm trying to limit which characters can be used in the request URI using: RewriteEngine on RewriteCond %{REQUEST_URI} !^([a-z0-9\:\/\.\_\-]) [NC] RewriteRule ^.* - [F,L] For some reason it's ...
0
votes
1answer
378 views

Difference between SetEnvIf and RewriteCond?

In my .htaccess file, I'm currently using RewriteCond to match the user agent of bad bots. I know that SetEnvIf can also be used to block bad bots too. The question is, what's the difference between ...
0
votes
2answers
325 views

Website needs to only be accessible from two specific iPad's and no other devices or IP's (PHP)

The business I work for has a website for employees to clock in and out of their work shifts. This website needs to be only accessible from our two in-house iPads. I tried doing a simple .htaccess ...
0
votes
2answers
179 views

.htaccess regular expressions for optimal performance?

In my .htaccess file I'm trying to block some bots using: RewriteCond %{HTTP_USER_AGENT} ^badbot [NC] But, I want to change these conditions to something more inclusive like: Method #1: ...
1
vote
4answers
261 views

Help! Why do blocked bots still waste bandwidth?

I've blocked a majority of bots that keep sending POST requests to my website, using .htaccess. Each time one of these bots tries to access my website it receives a 403 forbidden error message. My ...
0
votes
1answer
140 views

Script and file execution security with .htaccess

I'm trying to figure out which method I should use to control script/file execution security. I'm trying to protect against malicious file upload/execution exploits where a user could potentially ...
1
vote
2answers
296 views

.htaccess security

In my .htaccess file I've been trying to figure out if I should use: Options None which of course would disable all extra options, but I've been reading mixed opinions concerning the use of "Options ...
0
votes
2answers
250 views

Why isn't this .htaccess file working?

Recently, my website was hammered with thousands of POST requests from various bots. Instead of taking the approach of blocking these bots based on their user agent, I've decided to find a way to ...
0
votes
2answers
48 views

Hosting part of a website under a different domain

I have a website where we want to move the admin portion to a different URL (for security purposes, according to the site owner). So, to make the admin section accessible only from this new domain ...
2
votes
3answers
1k views

.htaccess to deny access to most xml files

I recently had a Joomla site hacked, so I'm trying to harden the site a bit. There's a section in the recommended .htaccess that restricts outside access to the xml files that come with extensions. ...
2
votes
2answers
1k views

How do I prevent my swf files being hotlinked, downloaded etc

I have swf files that are embedded in a PHP page using SWFObject. These swf files are in the same directory as my PHP files. for example www.myurl.com/index.php embeds www.myurl.com/flashfile.swf, ...
2
votes
1answer
1k views

allowing index access only with .htaccess

I have this in my .htaccess file, in the site root: Options -Indexes <directory ../.*> Deny from all </directory> <Files .htaccess> order allow,deny deny from all </Files> ...
0
votes
1answer
296 views

Blocking IP Range in .htaccess Problem

I'm trying to block the access of one of my webapps using IP Filter in the .htaccess, the problem is that after updating the file with: order allow,deny deny from 58.14.0.0/15 allow from all I get ...
1
vote
0answers
915 views

Set up SSL/HTTPS in zend application via .htaccess

I have been battling with .htaccess rules to get my SSL setup working right for the past few days.I get a requested URL not found error whenever I try access any requests that does not do through the ...
0
votes
1answer
377 views

IIS7 authentication

To give our user's the ability to protect content on their IIS6 sites we used a tool called IISPassword which emulates .htaccess to provide Basic authentication. There isn't support for IISPassword ...
1
vote
2answers
943 views

Use .htaccess to block *All* access to specific folders

I am not sure how to do this, but I want to block all access to a specific set of folders on my web server. Say secret01 and secret 02... homeDir |- data |- www | |- .htaccess (file) | |- ...
0
votes
2answers
2k views

Where should I put my htpasswd file in a plesk domain for use with .htaccess?

I've got a path in my domain which needs apache to prompt for a password. I'll be using the .htaccess file to do this, so I can protect or unprotect by adding or removing the file. I need a place to ...
1
vote
2answers
2k views

Turning HTTPS on via .htaccess

I currently have a site where I am using .htaccess to turn https on for certain sections of the site: RewriteCond %{HTTPS} off RewriteCond %{REQUEST_URI} (evaluate/purchase*) RewriteRule (.*) ...
0
votes
2answers
1k views

prevent the browser from downloading doc docx and pdf

i have some indexed document files ( .doc , .docx and .pdf ) stored in a folder in the website. when i type the full address of the file ( ex http://www.website.com/folder1/folder2/1.doc ) the ...
1
vote
2answers
376 views

.htaccess redirect - Is it secure?

This works; I'm not having trouble, but I want to be certain that this is bulletproof. I came up with a neat little .htaccess redirect, but I am not sure if it is secure; do you know? <IfModule ...
19
votes
3answers
512 views

Suspicious .htaccess File

This was uploaded to one of my FTP folders. I'm not familiar with Apache, but still curious - can someone tell me what type of dastardly act this file is trying to commit? Thanks! RewriteEngine On ...
0
votes
1answer
1k views

How to modify allow_url_fopen Local Value

This is a question about PHP configuration on a LAMP server. I want to turn off allow_url_fopen on one virtual host but not the other (i.e. can't turn it off globally in php.ini). The other day I had ...
1
vote
2answers
168 views

Secure .svn folders

I would like to know if it's unsecure to leave the .svn folders accessible to anyone on a webserver eg. : http://yoursite.com/.svn/ if not what's the best way to secure these?
0
votes
4answers
2k views

Protected Apache web sub-directory asks for password twice

I have an Apache server with password-protected web directory. That directory has a sub-directory, which requires another password, but anyone who can access the sub-directory should have access to ...
1
vote
3answers
629 views

Preventing access to files if a user types the full url on the address bar

i have a website, some folders on the websites contains images and files like .pdf , .doc and .docx . the user can easly just type the address in the url to get the file or display the photo ...
2
votes
2answers
244 views

How do I prevent directory browsing for all but valid users in .htaccess?

I'd like to allow directory browsing for users logged in via HTTP Basic authentication but prevent it for anonymous users. Is there a way to do this using .htaccess?