Wiki

Security:htaccess: Difference between revisions

← Older edit
Kangtain (talk | contribs)
Bureaucrats, Interface administrators, Suppressors, Administrators
9,154 edits
VisualWikitext
 
(One intermediate revision by the same user not shown)
Line 107: Line 107:




<syntaxhighlight lang="apache" line="1">
<syntaxhighlight lang="apache">
# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
# DISABLE UNAUTHORIZED DIRECTORY BROWSING
# DISABLE UNAUTHORIZED DIRECTORY BROWSING
Line 116: Line 116:


Options -Indexes
Options -Indexes


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 128: Line 127:


ServerSignature Off
ServerSignature Off


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 138: Line 136:


SetEnv APPLICATION_ENV production
SetEnv APPLICATION_ENV production


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 187: Line 184:
   </filesmatch>
   </filesmatch>
</ifmodule>
</ifmodule>


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 206: Line 202:


DefaultLanguage en-US
DefaultLanguage en-US


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 219: Line 214:


AddDefaultCharset UTF-8
AddDefaultCharset UTF-8


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 235: Line 229:


DirectoryIndex index.php index.html
DirectoryIndex index.php index.html


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 245: Line 238:


RewriteEngine On
RewriteEngine On


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 261: Line 253:
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R=302,L]
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R=302,L]


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 271: Line 262:
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 281: Line 271:
RewriteCond %{QUERY_STRING} .
RewriteCond %{QUERY_STRING} .
RewriteRule ^$ /? [R,L]
RewriteRule ^$ /? [R,L]


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 292: Line 281:
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule .* index.php/$0 [PT,L]
RewriteRule .* index.php/$0 [PT,L]


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 318: Line 306:
# return 403 forbidden header and show the content of the root homepage
# return 403 forbidden header and show the content of the root homepage
RewriteRule .* index.php [F]
RewriteRule .* index.php [F]


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 356: Line 343:
php_value session.cookie_httponly on
php_value session.cookie_httponly on
php_value session.cookie_secure on
php_value session.cookie_secure on


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 363: Line 349:
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^([^\.]+)$ $1.php [NC,L]
RewriteRule ^([^\.]+)$ $1.php [NC,L]


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 372: Line 357:
Deny from all
Deny from all
</LimitExcept>
</LimitExcept>


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 381: Line 365:
Deny from all
Deny from all
</files>
</files>


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 390: Line 373:
Deny from all
Deny from all
</FilesMatch>
</FilesMatch>


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 396: Line 378:
# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Deny from all
Deny from all


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 406: Line 387:
   </IfModule>
   </IfModule>
</FilesMatch>
</FilesMatch>


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 447: Line 427:
</Filesmatch>
</Filesmatch>
</ifmodule>
</ifmodule>


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 466: Line 445:
</FilesMatch>
</FilesMatch>
</IfModule>
</IfModule>


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 479: Line 457:
Header set X-Frame-Options "SAMEORIGIN"
Header set X-Frame-Options "SAMEORIGIN"
</IfModule>
</IfModule>


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 487: Line 464:
Header set X-Content-Type-Options "nosniff"
Header set X-Content-Type-Options "nosniff"
</IfModule>
</IfModule>


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 495: Line 471:
Header append X-XSS-Protection: "1; mode=block;"
Header append X-XSS-Protection: "1; mode=block;"
</IfModule>
</IfModule>


# +-------------------------------------------------------------------------+
# +-------------------------------------------------------------------------+
Line 503: Line 478:
RewriteRule ^ - [F]
RewriteRule ^ - [F]
</syntaxhighlight>
</syntaxhighlight>


==Source==
==Source==
Retrieved from "https://kangtain.com/wiki/index.php/Security:htaccess"