Directory-level configuration file found mostly on Apache web servers

learn more… | top users | synonyms (1)

19
votes
3answers
520 views

Suspicious .htaccess File

This was uploaded to one of my FTP folders. I'm not familiar with Apache, but still curious - can someone tell me what type of dastardly act this file is trying to commit? Thanks! RewriteEngine On ...
15
votes
3answers
27k views

How to redirect root and only root via htaccess?

I want to redirect only my root to another url, but maintain all the /sub/directories where they belong (and redirect) example: mysite.com/1 redirects to somewhere mysite.com/admin opens a page i ...
15
votes
4answers
21k views

How to get apache2 to redirect to a subdirectory

I am running apache2 on debian etch, with multiple virtual hosts. I want to redirect so that http://git.example.com goes to http://git.example.com/git/ Should be really simple, but google isn't ...
14
votes
3answers
26k views

How to enable either Gzip or Deflate compression via .htaccess?

How to enable either Gzip or Deflate compression via .htaccess and which one is best these days? Code examples needed.
9
votes
3answers
2k views

How do I obscure my Wordpress install via htaccess?

(I am aware that security via obscurity is not recommended). I am trying to hide the fact that I am using Wordpress. This post is helpful, but it only addresses the content (sort of). I am interested ...
9
votes
10answers
793 views

.htaccess doesn't redirect to www-prefixed page properly

I'm trying to redirect an url without www. to www.version (domain.cz to www.domain.cz). I use the usual RewriteCond %{HTTP_HOST} ^domain\.cz [nc] RewriteRule (.*) http://www.domain.cz/$1 [R=301,L] ...
8
votes
1answer
182 views

Create VHost & Forward subdomain to it

Gurus of So I have a simple .htaccess file where I only redirect non www to www for my webapp. Now what I want to do is Create a new vhost like http://subdomain.mydomain.tld Create a redirect for ...
8
votes
2answers
15k views

Configuring favicon with expires header in htaccess

I have implemented Expires headers via mod_expires on my Apache server and have successfully created expires headers for most file types, however I am having trouble with the favicon. I initially ...
8
votes
1answer
19k views

What is the name and location of the Nginx config file (htaccess equivalent)?

There are many tutorials on how to write Nginx rewrite rules to mimic Apache's .htaccess file but I can't confidently say I know what the name or location of this so-called Nginx config file actually ...
8
votes
5answers
1k views

How to prevent hot linking (“image theft” / “bandwidth theft”) of ressources on my site?

I'm trying to write the "ultimate" anti hot linking .htaccess... You can find many examples/tutorials/generators on the net but many of them are wrong or incomplete (or even both). These are the ...
7
votes
3answers
5k views

Limit upload file size and redirect user to error page if limit exceeds

Is it possible to redirect user to file file too big page when POST request size exceeds specified limit? I am aware about max-request-size option, but it gives just static page that cannot be ...
7
votes
2answers
562 views

Dissecting a website attack through a compromised FTP account

My site has been hacked and at this point, I know some details, but I'm at a loss at exactly how it happened or how to prevent it in the future. I need your help in trying to dissect the attack so ...
7
votes
1answer
2k views

SSL redirect on EC2 instance behind SSL terminating load balancer

I'm trying to redirect all url's to https in a web application. I have an ec2 instance behind an elastic load balancer. SSL is terminated on the load balancer. Any attempts at redirection end up ...
7
votes
4answers
15k views

How to solve “ExpiresActive not allowed here” error message in .htaccess file?

I am trying to add Expires headers to the HTTP responses of the site I am working on. The only way for me to control the Apache 1.3 server is by editing my .htaccess file. I tried adding code such as ...
7
votes
3answers
9k views

Allow using php_value and php_flag in .htaccess

I am running an Apache web server with PHP5 as a module (notice: as an Apache module, not CGI!). In some of my .htaccess files (the one that comes with the gallery3 software, ...
7
votes
2answers
2k views

Bypassing htaccess restrictions?

I found this in my apache access logs access.log:555.555.555.555 - - [05/May/2011:12:12:21 -0400] "GET /somedir/ HTTP/1.1" 403 291 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 ...
6
votes
9answers
1k views

Successfully, permanently ban a user from a website? [closed]

I have a social networking website and I want to ban a user from the website. I've added his IP address to the ban list in the .htacess file and to the php level for banning that user, but he keeps ...
6
votes
3answers
10k views

Creating a cookie-free domain to serve static content

I am trying to create a "example.com" domain to serve static content to my original domain. How would I make the "example.com" domain to so its cookie-free when loading content? I am thinking that ...
6
votes
4answers
861 views

Relative substitution in mod_rewrite RewriteRule

I want to create a mod_rewrite RewriteRule which is independent from the location where the web page is installed. I want to define the rewrite rule in a .htaccess file. Let's take this as an example: ...
6
votes
2answers
6k views

How to echo out from .htaccess?

We write a lot of code to htaccess but what is the best method to debug other than refreshing the page ? Is there some way that I can write it out to a file ? or is there some echo/print function ? ...
6
votes
1answer
3k views

max length of url 257 characters for mod_rewrite?

My url scheme is /foo/var1-var2-var3.../bar I am using these mod_rewrite rules: RewriteBase /foo/ RewriteEngine on RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d ...
6
votes
2answers
1k views

Vanity URL manager for Apache Web Server

I'm looking for a tool that manages vanity url's for a single domain running on Apache (or IHS - IBM HTTP Server). What i mean by vanity URL: www.mycompany.com/ProjectA would redirect to ...
6
votes
1answer
188 views

Htaccess application/type with PHP as FastCGI

Is there a way to use .htaccess with PHP as CGI/FastCGI? I would like to be able to have other extensions open as PHP. I have tried the following: AddType application/fcgid-script .phpd AddHandler ...
5
votes
3answers
3k views

Returning 404 code for unauthorized attempts

I have an admin directory on my web server (http://test.com/admin) and I don't want unauthorized parties to access this /admin/ directory instead I want to return 404 error code for all unauthorized ...
5
votes
1answer
10k views

Why does my RewriteLog not work?

I have an .htaccess which looks like this: RewriteEngine on RewriteLog "/Applications/MAMP/logs/rewrite_engine_log" RewriteCond %{REQUEST_URI} !/(index.php|css|images|js)/.*$ RewriteRule (.*) ...
5
votes
3answers
20k views

IIS7: How to block access with a web.config file?

I know that IIS7 allows me to have a per directory configuration with the web.config xml file. I have a directory with some configuration files that don't want to be web accessible. A local web.config ...
5
votes
2answers
4k views

Do I need to restart Apache if I modified an htaccess file?

So I changed an htaccess file on my server, and am not seeing the changes. Do I need to restart Apache if I modified an htaccess file? Update: So I don't think this is my problem. Please see my ...
5
votes
3answers
6k views

How can I password prompt certain IPs and allow all others free access using Apache?

SOLVED: The idea is that if the visitor comes from China they have to pass a basic authentication. If you have any other IP address you can visit the site without being hassled (including proxies) ...
5
votes
1answer
355 views

Apache deflates .xml.gz files

I noticed an error in google webmaster tools regarding a gzipped version of a sitemap. Turns out the sitemap.xml.gz file is gzipped twice: one upon creation (as it should be) and another time when ...
5
votes
3answers
6k views

How to redirect from HTTPS to HTTP before server error?

I used to operate a website with an SSL certificate, but have stopped using the SSL certificate. The problem is that most of the external links to the website use the https:// prefix. I have tried ...
5
votes
1answer
101 views

How to minimise effect of mischievous, persistent POST requests

For a few months now one of our shared hosting servers has been persistently and constantly hammered by "POST /" requests from what must be hundreds of thousands of individual IPs. On a number of ...
5
votes
3answers
341 views

Is my webserver allowing pre-fetching?

I have an image based website that hosts multiple galleries. When a user clicks one of the images the views property for the particular image is incremented. However, I noticed when using Firefox ...
5
votes
3answers
532 views

Redirection by IP causing infinite loop

I am working to transfer a server from one box to another and do a massive code update tonight. To do this I'd like to set up a redirection so that normal site visitors go to a holding page. But ...
5
votes
2answers
657 views

Finding Webserver Vulnerability

We operate a webserver farm hosting around 300 websites. Yesterday morning a script placed .htaccess files owned by www-data (the apache user) in every directory under the document_root of most (but ...
5
votes
2answers
2k views

Can I password protect a location (not directory) in apache using htaccess?

I have used code like this in apache configuration to protect locations with password <Location ~ "/admin.*"> AuthType Basic AuthName "Protected Area" AuthUserFile ...
5
votes
1answer
1k views

Apache 2.4 with PHP-FPM .htaccess redirection

I have Apache 2.4 set up with PHP-FPM on a server. To pass from Apache to PHP-FPM I use the following: ProxyPassMatch ^/(.*\.php)$ fcgi://127.0.0.1:9001/hosting_files/site.com/admin_secure/$1 ...
5
votes
1answer
1k views

.htaccess rewrite http to https results in loop

On an apache 2.2 server running varnish, I am trying to redirect http -> to https for an entire Drupal Commons (http://commons.acquia.com/) site. Since varnish caches some redirects (R=301, but not ...
4
votes
5answers
31k views

How do I use .htaccess to always redirect from HTTP to HTTPS?

There's a few similar questions which I tried to work out the answer from, but so far I have been unsuccessful. Please advise how I can always redirect http to https (and also remove www. from the ...
4
votes
2answers
531 views

Forwarding 80 to 443 on Nagios woes

I perhaps just need some extra insight because I don't see where I'm going wrong. I used an SSL Cert to secure our nagios server. We want to specifically require all traffic over nagios (like 2 users, ...
4
votes
4answers
2k views

How to set up a DNS to use a catch-all address?

This is not really a programming question, it's more about settings that I can alter visually. I have bought a domain and am wondering how I can get it work in such a way that everything before the ...
4
votes
1answer
3k views

How can I remove HTTP headers with .htaccess in Apache?

I have a website that is sending out "cache-control" and "pragma" HTTP headers for PHP requests. I'm not doing that in the code, so I'm assuming it's some kind of Apache configuration, as suggested by ...
4
votes
3answers
758 views

How to block Baidu from indexing MP3 files?

Using Apache I want to prevent people from directly downloading music via url. I just want the flash player to play it. However Baidu MP3 found the files and is establishing direct downloads to my ...
4
votes
1answer
1k views

Don't use htpasswd if coming from local host

I have a development site that, for an additional layer of protection to keep preying eyes away, I have behind a htpasswd file. However, I'm getting tired of typing in the username and password when ...
4
votes
1answer
2k views

Unable to set php_value in .htaccess file

I am trying to set up NewRelic on my Apache2/PHP server, and have it report different applications per vhost. To do this, the php value newrelic.appname must be changed. It is defined by default in ...
4
votes
1answer
2k views

force https with apache before .htpasswd

I have this in my .htaccess file RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^(.*)$ https://www.myweb.com/phpmyadmin$1 [R,L] AuthUserFile /var/www/myweb/.htpasswd AuthGroupFile /dev/null ...
4
votes
2answers
3k views

Precedence of RewriteRules in .htaccess file on Apache Server

I have a number of RewriteRules in my .htaccess file. However, one specific rule is only executed if I remove another specific rule, regardless of how I order the two rules. Here's the rule which ...
4
votes
4answers
5k views

.htaccess not working (mod_rewrite)

Edit: I am pretty sure my .htaccess file is NOT being executed, and the problem is NOT with my rewrite rules. I have not having any luck getting my .htaccess with mod_rewrite working. Basically all ...
4
votes
1answer
3k views

Why would an .htaccess file result in 403 Forbidden when the only line is “Allow from all”?

I'm running a server: Apache/2.2.8 (Ubuntu) mod_ssl/2.2.8 OpenSSL/0.9.8g Without a .htaccess file, everyone can access the web content. However, I add a .htaccess file with the following content: ...
4
votes
4answers
6k views

.htaccess file hacked, how to prevent this in future? [closed]

The hacker added a code in .htaccess file to redirect all search engine traffic to a malware website. I am now investigating this incident and trying to find out security loop holes. My situation is ...
4
votes
2answers
3k views

IIS Basic Authorization ala .htaccess/.htpasswd in apache

How do I implement the protection of the pages (asp.net mvc app), so when I hit the home page or any other pages within the application I get a login dialog popup in the browser I'm looking for ...