Htaccess examples (security): Revision history

19 December 2014

• curprev 14:1114:11, 19 December 2014 Tom Hutchison talk contribs m 29,677 bytes +64 →Suggested Master htaccess file: experimental

9 October 2013

• curprev 15:4115:41, 9 October 2013 Phild talk contribs 29,613 bytes −94 →External links: removed dead external links and updated other external links as necessary

15 July 2013

• curprev 17:3217:32, 15 July 2013 Phild talk contribs 29,707 bytes +852 Reordered page sections. Expanded warning note

14 July 2013

• curprev 20:3220:32, 14 July 2013 Phild talk contribs m 28,855 bytes 0 Protected "Htaccess examples (security)": Prevent unauthorized editing of htaccess file (‎[edit=sysop] (indefinite) ‎[move=sysop] (indefinite))
• curprev 17:4517:45, 14 July 2013 Mandville talk contribs 28,855 bytes +19 No edit summary

15 October 2012

• curprev 12:1312:13, 15 October 2012 Tom Hutchison talk contribs m 28,836 bytes +45 displaytitle to make htaccess lowercase

28 January 2012

• curprev 00:4200:42, 28 January 2012 Mandville talk contribs m 28,791 bytes 0 Protected "Htaccess examples (security)": Counter-productive edit warring ([edit=sysop] (expires 00:42, 28 February 2012 (UTC)) [move=sysop] (expires 00:42, 28 February 2012 (UTC)))

27 January 2012

• curprev 23:3323:33, 27 January 2012 Phild talk contribs 28,791 bytes +363 Undo revision 64362 by Ahmad (talk) PhilD

22 January 2012

• curprev 11:0311:03, 22 January 2012 Ahmad talk contribs 28,428 bytes −363 →Suggested Master htaccess file: Updated the file version from Nicholas Dionysopoulos SVN

3 October 2011

• curprev 14:3114:31, 3 October 2011 Isidrobaq talk contribs 28,791 bytes +21 →External links

13 September 2011

• curprev 23:3423:34, 13 September 2011 Phild talk contribs 28,770 bytes +138 →Suggested Master htaccess file: added line (297) to explicitly allow the forum post assistant (fpa-xx) script to run

17 May 2011

• curprev 21:0221:02, 17 May 2011 G1smd talk contribs 28,632 bytes +284 Proposed 2.5.5 - Change rule order to prevent URL request with query string exploit accidentally being allowed when a previous "RewriteRule - [L]" exception stopped processing of request "too early".
• curprev 20:5420:54, 17 May 2011 G1smd talk contribs 28,348 bytes 0 Proposed 2.5.4 - Change rule order to prevent URL request with exploit accidentally being allowed when a previous "RewriteRule - [L]" exception has stopped the processing of that request "too early".
• curprev 20:4520:45, 17 May 2011 G1smd talk contribs 28,348 bytes 0 Proposed 2.5.3 - Changing rule order such that mod_rewrite and other setup code is placed closer to the rules that it applies to and is therefore easier to follow.
• curprev 20:4120:41, 17 May 2011 G1smd talk contribs 28,348 bytes 0 Proposed 2.5.2 - Redirecting a malicious request only to later block it is inefficient. Move external redirect mod_rewrite code to be after the mod_rewrite code which blocks malicious requests.
• curprev 20:3320:33, 17 May 2011 G1smd talk contribs 28,348 bytes +32 Proposed 2.5.1 - Change rule order to prevent an unwanted multiple step redirection chain when a non-www URL on the old domain and/or a URL which is going to be forced to https is requested.
• curprev 20:2920:29, 17 May 2011 G1smd talk contribs 28,316 bytes +354 Proposed 2.5.0 - Added placeholders for custom mod_rewrite rules using RewriteRule [F] (blocking), RewriteRule [R=301,L] (redirecting) and RewriteRule [L] (rewriting). [Compare with version 2.4.9.]

16 May 2011

• curprev 00:3700:37, 16 May 2011 Nikosdion code talk contribs 27,962 bytes −4 [db3f6e8426] 2011-04-24 08:53 (3.3.c) Referer filtering would block incoming requests from Google AdWords, PayPal etc when they were requesting dynamic pages (generated on the fly) with html suffix.
• curprev 00:2900:29, 16 May 2011 Nikosdion code talk contribs 27,966 bytes +102 [7f16b19281] 2011-04-17 21:08 (3.3.b) Tested and working. Reverted some patterns back to .* rather than fix them. Re-added one "-f" check. (Noted later: introduced a typo, "$1" instead of "-".)
• curprev 00:2000:20, 16 May 2011 Nikosdion code talk contribs 27,864 bytes +100 [ac17649143] 2011-04-17 15:04 (3.3.a) Rolling back all of the optimizations because they cause a lot of problems. For example, images like "this.is.a.valid.image.png" are not taken into account.

15 May 2011

• curprev 22:4622:46, 15 May 2011 Nikosdion code talk contribs 27,764 bytes −1 [7946abcbe0] 2011-04-16 21:33 (3.2.f) Typo in the ico rule. Remove errant question mark. (Compare with version 2.4.6 to see the suggestions that have not been implemented.)
• curprev 22:3722:37, 15 May 2011 Nikosdion code talk contribs 27,765 bytes −5 [eb67bf292b] 2011-04-16 06:43 (3.2.e) Typos. Remove errant space. Change domain.com to example.com. Add vcf to URL extensions that can be rewritten.
• curprev 22:3222:32, 15 May 2011 Nikosdion code talk contribs 27,770 bytes −12 [e439c8e078] 2011-04-15 14:05 (3.2.d) Typos. Remove "html?" from two RegEx patterns. Fix [F] to [L]. Fix [L] to [F]. The latter two were typos introduced in earlier revisions.
• curprev 22:2622:26, 15 May 2011 Nikosdion code talk contribs 27,782 bytes +20 [7dd7b56542] 2011-04-11 21:50 (3.2.c) Bug in file injection prevention code. Disable access to php.ini. Update of forwarding to index.php rule to match Joomla! 1.6. Small changes in comments section
• curprev 22:2322:23, 15 May 2011 Nikosdion code talk contribs 27,762 bytes −10 [01a97dff0a] 2011-04-11 20:36 (3.2.b) Bug fixes in RegEx's. Change Redirect to RewriteRule. Fixed various RegEx patterns. (Noted later: several errors missed or introduced here.)
• curprev 22:1622:16, 15 May 2011 Nikosdion code talk contribs 27,772 bytes +148 [4e9b8df0c7] 2011-04-09 07:06 (3.2.a) Slight changes with negligible performance impact. Backreferences don't need to be created on some patterns. End anchoring needed on one other pattern.
• curprev 17:5517:55, 15 May 2011 Nikosdion code talk contribs 27,624 bytes −316 [00498b45e5] 2011-04-05 18:12 (3.1.l) Removed some unnecessary -f checks. (Note: when site broke, added them back in later.) Removed the old-domain index canonicalisation rule.
• curprev 17:5117:51, 15 May 2011 Nikosdion code talk contribs 27,940 bytes +26 [ecacd286c8] 2011-04-04 16:50 (3.1.k) Added changelog for version 3.1.
• curprev 17:4417:44, 15 May 2011 Nikosdion code talk contribs 27,914 bytes +513 [bab4007c50] 2011-04-04 13:56 (3.1.j) Added comments to Joomla! core SEF section. The words are much the same as found in Joomla 1.5.23 and 1.6.2 and are as suggested by g1smd.
• curprev 17:4017:40, 15 May 2011 Nikosdion code talk contribs 27,401 bytes +893 [81893d126f] 2011-04-04 13:51 (3.1.i) Back-end and front-end protection optimization. Fixed the UNION SELECT SQLi rule to actually work against real attacks. Optimised several more RegEx patterns.
• curprev 17:3517:35, 15 May 2011 Nikosdion code talk contribs 26,508 bytes +111 [fc1892bc92] 2011-04-04 13:14 (3.1.h) Bug in query string protection rule. Fixed several typos.
• curprev 17:3217:32, 15 May 2011 Nikosdion code talk contribs 26,397 bytes +164 [13ddfe907d] 2011-04-04 12:55 (3.1.g) Common exploits protection: Minor changes in comments, combined base64_encode/base64_decode rule. Based on suggestions by g1smd.
• curprev 17:2917:29, 15 May 2011 Nikosdion code talk contribs 26,233 bytes +187 [a1cacc8194] 2011-04-04 10:52 (3.1.f) Alternative for HTTP to HTTPS redirection. Check SERVER_PORT instead of HTTPS. Change [L,R] to [R=301,L]. Suggestions from g1smd. Added notes.
• curprev 17:2517:25, 15 May 2011 Nikosdion code talk contribs 26,046 bytes +175 [2b28233a9b] 2011-04-04 10:49 (3.1.e) Typos in www to non-www, non-www to www and old domain to new domain redirection code. Changed [R,L] and [L=301,R] to [R=301,L]. Added notes.
• curprev 17:2017:20, 15 May 2011 Nikosdion code talk contribs 25,871 bytes +4 [7ad86544c8] 2011-04-04 10:44 (3.1.d) GET variables not passed along in the index.php to site root redirection. Altered redirect to work only for root index.php requests.
• curprev 17:1617:16, 15 May 2011 Nikosdion code talk contribs 25,867 bytes +36 [8e877e9a01] 2011-04-04 10:41 (3.1.c) Expiration time of static resources adjusted to 1 month instead of 1 year. Suggestion from g1smd http://www.webmasterworld.com/apache/4118917.htm#msg4119380
• curprev 17:0517:05, 15 May 2011 Nikosdion code talk contribs 25,831 bytes −206 [3db9a25706] 2011-04-04 10:39 (3.1.b) Typo fixed. Spelling.
• curprev 17:0217:02, 15 May 2011 Nikosdion code talk contribs 26,037 bytes +283 [aff5fda718] 2011-04-04 10:37 (3.1.a) Importing version 3.0. Now using GitHub code repository. Changed domain.com to example.com. Reverted to using greedy and ambiguous .* RegEx patterns.
• curprev 16:5616:56, 15 May 2011 Nikosdion code talk contribs 25,754 bytes −1,765 [from-snipt] 2011-03-28 03:03 (3.0.a) A random copy tagged as Version 3.0 as originally hosted at snipt.net. Incorporates some of the recent optimisation suggestions from g1smd.

14 May 2011

• curprev 14:0314:03, 14 May 2011 G1smd talk contribs 27,519 bytes +114 URL updates.

8 May 2011

• curprev 20:2120:21, 8 May 2011 G1smd talk contribs 27,405 bytes +3 Proposed file for version 2.4.9 with more changes.

23 April 2011

• curprev 23:3323:33, 23 April 2011 G1smd talk contribs m 27,402 bytes +219 URLs updated.
• curprev 10:5110:51, 23 April 2011 G1smd talk contribs 27,183 bytes +40 Proposed file for version 2.4.8 with more changes.
• curprev 10:1410:14, 23 April 2011 G1smd talk contribs 27,143 bytes +176 Proposed file for version 2.4.7 with more changes.
• curprev 10:1210:12, 23 April 2011 G1smd talk contribs 26,967 bytes −2 Proposed file for version 2.4.6 with more changes.

17 April 2011

• curprev 18:0518:05, 17 April 2011 G1smd talk contribs 26,969 bytes −7 Proposed file for version 2.4.6 with more changes. Many logic errors as well as a number of typos have been corrected in this and recent versions.

11 April 2011

• curprev 23:2723:27, 11 April 2011 G1smd talk contribs m 26,976 bytes +135 Updated some URLs.
• curprev 23:1523:15, 11 April 2011 G1smd talk contribs 26,841 bytes +135 Proposed file for version 2.4.5 with more changes.

10 April 2011

• curprev 07:2207:22, 10 April 2011 G1smd talk contribs 26,706 bytes +227 Proposed file for version 2.4.4 with more changes.

3 April 2011

• curprev 00:1100:11, 3 April 2011 G1smd talk contribs 26,479 bytes −1 Proposed file for version 2.4.3 with more changes.