WordPress:Mengamankan dengan htaccess - Revision history

Kangtain at 07:32, 25 August 2022

2022-08-25T07:32:21Z

← Older revision		Revision as of 14:32, 25 August 2022
Line 1:		Line 1:
	===Block Bad Bots===		===Block Bad Bots===
	# Block one or more IP address.		<syntaxhighlight lang="apacheconf">
	# Replace IP_ADDRESS_* with the IP you want to block		# Block one or more IP address.
			# Replace IP_ADDRESS_* with the IP you want to block
	<Limit GET POST>
	order allow,deny		<Limit GET POST>
	deny from IP_ADDRESS_1		order allow,deny
	deny from IP_ADDRESS_2		deny from IP_ADDRESS_1
	allow from all		deny from IP_ADDRESS_2
	</Limit>		allow from all
			</Limit>
			</syntaxhighlight>

	===Disable Directory Browsing===		===Disable Directory Browsing===
	# Disable directory browsing		<syntaxhighlight lang="apacheconf">
	Options All -Indexes		# Disable directory browsing
			Options All -Indexes
			</syntaxhighlight>

	===Allow Only Selected Files from wp-content===		===Allow Only Selected Files from wp-content===
	# Disable access to all file types except the following		<syntaxhighlight lang="apache">
	Order deny,allow		# Disable access to all file types except the following
	Deny from all		Order deny,allow
	<Files ~ ".(xml\|css\|js\|jpe?g\|png\|gif\|pdf\|docx\|rtf\|odf\|zip\|rar)$">		Deny from all
	Allow from all		<Files ~ ".(xml\|css\|js\|jpe?g\|png\|gif\|pdf\|docx\|rtf\|odf\|zip\|rar)$">
	</Files>		Allow from all
			</Files>
			</syntaxhighlight>

	===Restrict All Access to wp-includes===		===Restrict All Access to wp-includes===
	# Block wp-includes folder and files		<syntaxhighlight lang="apache">
	<IfModule mod_rewrite.c>		# Block wp-includes folder and files
	RewriteEngine On		<IfModule mod_rewrite.c>
	RewriteBase /		RewriteEngine On
	RewriteRule ^wp-admin/includes/ - [F,L]		RewriteBase /
	RewriteRule !^wp-includes/ - [S=3]		RewriteRule ^wp-admin/includes/ - [F,L]
	RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]		RewriteRule !^wp-includes/ - [S=3]
	RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]		RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
	RewriteRule ^wp-includes/theme-compat/ - [F,L]		RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
	</IfModule>		RewriteRule ^wp-includes/theme-compat/ - [F,L]
			</IfModule>
			</syntaxhighlight>

	===Allow only Selected IP Addresses to Access wp-admin===		===Allow only Selected IP Addresses to Access wp-admin===
	# Limit logins and admin by IP		<syntaxhighlight lang="apacheconf">
	<Limit GET POST PUT>		# Limit logins and admin by IP
	order deny,allow		<Limit GET POST PUT>
	deny from all		order deny,allow
	allow from 302.143.54.102		deny from all
	allow from IP_ADDRESS_2		allow from 302.143.54.102
	</Limit>		allow from IP_ADDRESS_2
			</Limit>
			</syntaxhighlight>

	===Protect wp-config.php and .htaccess from everyone===		===Protect wp-config.php and .htaccess from everyone===
	# Deny access to wp-config.php file		<syntaxhighlight lang="apacheconf">
	<files wp-config.php>		# Deny access to wp-config.php file
	order allow,deny		<files wp-config.php>
	deny from all		order allow,deny
	</files>		deny from all
			</files>

			</syntaxhighlight>

	===Deny Image Hotlinking===		===Deny Image Hotlinking===
	# Prevent image hotlinking script. Replace last URL with any image link you want.		<syntaxhighlight lang="apache">
	RewriteEngine on		# Prevent image hotlinking script. Replace last URL with any image link you want.
	RewriteCond %{HTTP_REFERER} !^$		RewriteEngine on
	RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?yourwebsite.com [NC]		RewriteCond %{HTTP_REFERER} !^$
	RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?yourotherwebsite.com [NC]		RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?yourwebsite.com [NC]
	RewriteRule \.(jpg\|jpeg\|png\|gif)$ http://i.imgur.com/MlQAH71.jpg [NC,R,L]		RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?yourotherwebsite.com [NC]
			RewriteRule \.(jpg\|jpeg\|png\|gif)$ http://i.imgur.com/MlQAH71.jpg [NC,R,L]
			</syntaxhighlight>

	===Enable Browser Caching===		===Enable Browser Caching===
	# Setup browser caching		<syntaxhighlight lang="apacheconf">
	<IfModule mod_expires.c>		# Setup browser caching
	ExpiresActive On		<IfModule mod_expires.c>
	ExpiresByType image/jpg "access 1 year"		ExpiresActive On
	ExpiresByType image/jpeg "access 1 year"		ExpiresByType image/jpg "access 1 year"
	ExpiresByType image/gif "access 1 year"		ExpiresByType image/jpeg "access 1 year"
	ExpiresByType image/png "access 1 year"		ExpiresByType image/gif "access 1 year"
	ExpiresByType text/css "access 1 month"		ExpiresByType image/png "access 1 year"
	ExpiresByType application/pdf "access 1 month"		ExpiresByType text/css "access 1 month"
	ExpiresByType text/x-javascript "access 1 month"		ExpiresByType application/pdf "access 1 month"
	ExpiresByType application/x-shockwave-flash "access 1 month"		ExpiresByType text/x-javascript "access 1 month"
	ExpiresByType image/x-icon "access 1 year"		ExpiresByType application/x-shockwave-flash "access 1 month"
	ExpiresDefault "access 2 days"		ExpiresByType image/x-icon "access 1 year"
	</IfModule>		ExpiresDefault "access 2 days"
			</IfModule>

			</syntaxhighlight>

	==Source==		== Source ==
	*[https://www.wpexplorer.com/htaccess-wordpress-security/ wpexplorer.com]		*[https://www.wpexplorer.com/htaccess-wordpress-security/ wpexplorer.com]

Kangtain: /* Source */

2022-03-19T09:38:04Z

Source

← Older revision		Revision as of 16:38, 19 March 2022
Line 80:		Line 80:
	[[Category:Security]]		[[Category:Security]]
	[[Category:CMS]]		[[Category:CMS]]
			[[Category:WordPress]]

Kangtain: /* Source */

2021-12-30T11:55:10Z

Source

← Older revision		Revision as of 18:55, 30 December 2021
Line 76:		Line 76:

	==Source==		==Source==
	*[https://www.wpexplorer.com/htaccess-wordpress-security/ .wpexplorer.com]		*[https://www.wpexplorer.com/htaccess-wordpress-security/ wpexplorer.com]

	[[Category:Security]]		[[Category:Security]]
	[[Category:CMS]]		[[Category:CMS]]

Kangtain: /* Protect wp-config.php and .htaccess from everyone */

2021-12-23T11:47:19Z

Protect wp-config.php and .htaccess from everyone

← Older revision		Revision as of 18:47, 23 December 2021
Line 44:		Line 44:

	===Protect wp-config.php and .htaccess from everyone===		===Protect wp-config.php and .htaccess from everyone===
			# Deny access to wp-config.php file
			<files wp-config.php>
			order allow,deny
			deny from all
			</files>

			===Deny Image Hotlinking===
			# Prevent image hotlinking script. Replace last URL with any image link you want.
			RewriteEngine on
			RewriteCond %{HTTP_REFERER} !^$
			RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?yourwebsite.com [NC]
			RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?yourotherwebsite.com [NC]
			RewriteRule \.(jpg\|jpeg\|png\|gif)$ http://i.imgur.com/MlQAH71.jpg [NC,R,L]

			===Enable Browser Caching===
			# Setup browser caching
			<IfModule mod_expires.c>
			ExpiresActive On
			ExpiresByType image/jpg "access 1 year"
			ExpiresByType image/jpeg "access 1 year"
			ExpiresByType image/gif "access 1 year"
			ExpiresByType image/png "access 1 year"
			ExpiresByType text/css "access 1 month"
			ExpiresByType application/pdf "access 1 month"
			ExpiresByType text/x-javascript "access 1 month"
			ExpiresByType application/x-shockwave-flash "access 1 month"
			ExpiresByType image/x-icon "access 1 year"
			ExpiresDefault "access 2 days"
			</IfModule>


			==Source==
			*[https://www.wpexplorer.com/htaccess-wordpress-security/ .wpexplorer.com]

			[[Category:Security]]
			[[Category:CMS]]

Kangtain: Created page with "===Block Bad Bots=== # Block one or more IP address. # Replace IP_ADDRESS_* with the IP you want to block order allow,deny deny from IP_ADDRESS_1 deny from IP_ADDRESS_2 allow from all ===Disable Directory Browsing=== # Disable directory browsing Options All -Indexes ===Allow Only Selected Files from wp-content=== # Disable access to all file types except the following Order deny,allow Deny from all
2021-12-23T11:43:31Z

Created page with "===Block Bad Bots=== # Block one or more IP address. # Replace IP_ADDRESS_* with the IP you want to block <Limit GET POST> order allow,deny deny from IP_ADDRESS_1 deny from IP_ADDRESS_2 allow from all </Limit> ===Disable Directory Browsing=== # Disable directory browsing Options All -Indexes ===Allow Only Selected Files from wp-content=== # Disable access to all file types except the following Order deny,allow Deny from all <Files ~ ".(xml|css|js|jpe?g|..."

New page
===Block Bad Bots===
# Block one or more IP address.
# Replace IP_ADDRESS_* with the IP you want to block

<Limit GET POST>
order allow,deny
deny from IP_ADDRESS_1
deny from IP_ADDRESS_2
allow from all
</Limit>

===Disable Directory Browsing===
# Disable directory browsing
Options All -Indexes

===Allow Only Selected Files from wp-content===
# Disable access to all file types except the following
Order deny,allow
Deny from all
<Files ~ ".(xml|css|js|jpe?g|png|gif|pdf|docx|rtf|odf|zip|rar)$">
Allow from all
</Files>

===Restrict All Access to wp-includes===
# Block wp-includes folder and files
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>

===Allow only Selected IP Addresses to Access wp-admin===
# Limit logins and admin by IP
<Limit GET POST PUT>
order deny,allow
deny from all
allow from 302.143.54.102
allow from IP_ADDRESS_2
</Limit>

===Protect wp-config.php and .htaccess from everyone===