Wiki

WordPress:Mengamankan dengan htaccess: Difference between revisions

← Older edit
Kangtain (talk | contribs)
Bureaucrats, Interface administrators, Suppressors, Administrators
9,154 edits
VisualWikitext
No edit summary
 
(One intermediate revision by the same user not shown)
Line 1: Line 1:
===Block Bad Bots===
===Block Bad Bots===
# Block one or more IP address.
<syntaxhighlight lang="apacheconf">
# Replace IP_ADDRESS_* with the IP you want to block
# Block one or more IP address.
# Replace IP_ADDRESS_* with the IP you want to block
<Limit GET POST>
 
order allow,deny
<Limit GET POST>
deny from IP_ADDRESS_1
order allow,deny
deny from IP_ADDRESS_2
deny from IP_ADDRESS_1
allow from all
deny from IP_ADDRESS_2
</Limit>
allow from all
</Limit>
</syntaxhighlight>


===Disable Directory Browsing===
===Disable Directory Browsing===
# Disable directory browsing
<syntaxhighlight lang="apacheconf">
Options All -Indexes
# Disable directory browsing
Options All -Indexes
</syntaxhighlight>


===Allow Only Selected Files from wp-content===
===Allow Only Selected Files from wp-content===
# Disable access to all file types except the following
<syntaxhighlight lang="apache">
Order deny,allow
# Disable access to all file types except the following
Deny from all
Order deny,allow
<Files ~ ".(xml|css|js|jpe?g|png|gif|pdf|docx|rtf|odf|zip|rar)$">
Deny from all
Allow from all
<Files ~ ".(xml|css|js|jpe?g|png|gif|pdf|docx|rtf|odf|zip|rar)$">
</Files>
Allow from all
</Files>
</syntaxhighlight>


===Restrict All Access to wp-includes===
===Restrict All Access to wp-includes===
# Block wp-includes folder and files
<syntaxhighlight lang="apache">
<IfModule mod_rewrite.c>
# Block wp-includes folder and files
RewriteEngine On
<IfModule mod_rewrite.c>
RewriteBase /
RewriteEngine On
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteBase /
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
</IfModule>
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>
</syntaxhighlight>


===Allow only Selected IP Addresses to Access wp-admin===
===Allow only Selected IP Addresses to Access wp-admin===
# Limit logins and admin by IP
<syntaxhighlight lang="apacheconf">
<Limit GET POST PUT>
# Limit logins and admin by IP
order deny,allow
<Limit GET POST PUT>
deny from all
order deny,allow
allow from 302.143.54.102
deny from all
allow from IP_ADDRESS_2
allow from 302.143.54.102
</Limit>
allow from IP_ADDRESS_2
</Limit>
</syntaxhighlight>


===Protect wp-config.php and .htaccess from everyone===
===Protect wp-config.php and .htaccess from everyone===
# Deny access to wp-config.php file
<syntaxhighlight lang="apacheconf">
<files wp-config.php>
# Deny access to wp-config.php file
order allow,deny
<files wp-config.php>
deny from all
order allow,deny
</files>
deny from all
</files>
 
</syntaxhighlight>


===Deny Image Hotlinking===
===Deny Image Hotlinking===
# Prevent image hotlinking script. Replace last URL with any image link you want.
<syntaxhighlight lang="apache">
RewriteEngine on
# Prevent image hotlinking script. Replace last URL with any image link you want.
RewriteCond %{HTTP_REFERER} !^$
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?yourwebsite.com [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?yourotherwebsite.com [NC]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?yourwebsite.com [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ http://i.imgur.com/MlQAH71.jpg [NC,R,L]
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?yourotherwebsite.com [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ http://i.imgur.com/MlQAH71.jpg [NC,R,L]
</syntaxhighlight>


===Enable Browser Caching===
===Enable Browser Caching===
# Setup browser caching
<syntaxhighlight lang="apacheconf">
<IfModule mod_expires.c>
# Setup browser caching
ExpiresActive On
<IfModule mod_expires.c>
ExpiresByType image/jpg "access 1 year"
ExpiresActive On
ExpiresByType image/jpeg "access 1 year"
ExpiresByType image/jpg "access 1 year"
ExpiresByType image/gif "access 1 year"
ExpiresByType image/jpeg "access 1 year"
ExpiresByType image/png "access 1 year"
ExpiresByType image/gif "access 1 year"
ExpiresByType text/css "access 1 month"
ExpiresByType image/png "access 1 year"
ExpiresByType application/pdf "access 1 month"
ExpiresByType text/css "access 1 month"
ExpiresByType text/x-javascript "access 1 month"
ExpiresByType application/pdf "access 1 month"
ExpiresByType application/x-shockwave-flash "access 1 month"
ExpiresByType text/x-javascript "access 1 month"
ExpiresByType image/x-icon "access 1 year"
ExpiresByType application/x-shockwave-flash "access 1 month"
ExpiresDefault "access 2 days"
ExpiresByType image/x-icon "access 1 year"
</IfModule>
ExpiresDefault "access 2 days"
</IfModule>


</syntaxhighlight>


==Source==
== Source ==
*[https://www.wpexplorer.com/htaccess-wordpress-security/ wpexplorer.com]
*[https://www.wpexplorer.com/htaccess-wordpress-security/ wpexplorer.com]


[[Category:Security]]
[[Category:Security]]
[[Category:CMS]]
[[Category:CMS]]
[[Category:WordPress]]
Retrieved from "https://kangtain.com/wiki/index.php/WordPress:Mengamankan_dengan_htaccess"