Security:htaccess
How to enable mod_rewrite in .htaccess file
mod_rewrite option allows you to use redirections and hiding your true URL with redirecting to some other URL. This option can prove very useful allowing you to replace the lengthy and long URL’s to short and easy to remember ones.
To allow mod_rewrite just have a practice to add the following line as the first line of your .htaccess file.
Options +FollowSymLinks
This option allows you to follow symbolic links and thus enable the mod_rewrite option on the website. Replacing the URL with short and crispy one is presented later on.
How to Allow or Deny Access to Websites
htaccess file can allow or deny access of website or a folder or files in the directory in which it is placed by using order, allow and deny keywords. Allowing access to only 192.168.3.1 IP
Order Allow, Deny Deny from All Allow from 192.168.3.1
Atau
Order Allow, Deny Allow from 192.168.3.1
Order keyword here specifies the order in which allow, deny access would be processed. For the above ‘Order’ statement, the Allow statements would be processed first and then the deny statements would be processed.
Denying access to only one IP Address
The below lines provide the means to allow access of the website to all the users accept one with IP Address: 192.168.3.1.
Order Allow, Deny Deny from 192.168.3.1 Allow from All
Atau
Order Deny, Allow Deny from 192.168.3.1
Generate Apache Error documents for different error codes
Using some simple lines, we can fix the error document that run on different error codes generated by the server when user/client requests a page not available on the website like most of us would have seen the ‘404 Page not found’ page in their web browser. ‘.htaccess’ files specify what action to take in case of such error conditions.
To do this, the following lines are needed to be added to the ‘.htaccess’ files:
ErrorDocument <error-code> <path-of-document/string-representing-html-file-content>
‘ErrorDocument’ is a keyword, error-code can be any of 401, 403, 404, 500 or any valid error representing code and lastly, ‘path-of-document’ represents the path on the local machine (in case you are using your own local server) or on the server (in case you are using any other’s server to host your website).
Example:
ErrorDocument 404 /error-docs/error-404.html
The above line sets the document ‘error-404.html’ placed in error-docs folder to be displayed in case the 404 error is reported by the server for any invalid request for a page by the client.
errorDocument 404 "<html><head><title>404 Page not found</title></head><body><p>The page you request is not present. Check the URL you have typed</p></body></html>"
The above representation is also correct which places the string representing a usual html file.
Setting/Unsetting Apache server environment variables
In .htaccess file you can set or unset the global environment variables that server allow to be modified by the hosters of the websites. For setting or unsetting the environment variables you need to add the following lines to your .htaccess files.
Setting the Environment variables
SetEnv OWNER “Gunjit Khera”
Unsetting the Environment variables
UnsetEnv OWNER
Defining different MIME types for files
MIME (Multipurpose Internet Multimedia Extensions) are the types that are recognized by the browser by default when running any web page. You can define MIME types for your website in .htaccess files, so that different types of files as defined by you can be recognized and run by the server.
<IfModule mod_mime.c>
AddType application/javascript js
AddType application/x-font-ttf ttf ttc
</IfModule>
Here, mod_mime.c is the module for controlling definitions of different MIME types and if you have this module installed on your system then you can use this module to define different MIME types for different extensions used in your website so that server can understand them.
How to Limit the size of Uploads and Downloads in Apache
.htaccess files allow you the feature to control the amount of data being uploaded or downloaded by a particular client from your website. For this you just need to append the following lines to your .htaccess file:
php_value upload_max_filesize 20M php_value post_max_size 20M php_value max_execution_time 200 php_value max_input_time 200
The above lines set maximum upload size, maximum size of data being posted, maximum execution time i.e. the maximum time the a user is allowed to execute a website on his local machine, maximum time constrain within on the input time.
# ____ _ _ _ ____ _ _ ____ _ _
# | __ ) ___| |_| |_ ___ _ __ __ _____| |__ | __ ) ___| |_| |_ ___ _ __ / ___| ___ ___ _ _ _ __(_) |_ _ _
# | _ \ / _ \ __| __/ _ \ '__| \ \ /\ / / _ \ '_ \ | _ \ / _ \ __| __/ _ \ '__| \___ \ / _ \/ __| | | | '__| | __| | | |
# | |_) | __/ |_| || __/ | \ V V / __/ |_) | | |_) | __/ |_| || __/ | ___) | __/ (__| |_| | | | | |_| |_| |
# |____/ \___|\__|\__\___|_| \_/\_/ \___|_.__( ) |____/ \___|\__|\__\___|_| |____/ \___|\___|\__,_|_| |_|\__|\__, |
# |/ |___/
#
# +-------------------------------------------------------------------------+
# DISABLE UNAUTHORIZED DIRECTORY BROWSING
# +-------------------------------------------------------------------------+
# Prevent a Directory Listing of Your Website with .htaccess
# Block a Directory Index from Being Shown
Options -Indexes
# +-------------------------------------------------------------------------+
# DISABLE THE SERVER SIGNATURE
# +-------------------------------------------------------------------------+
# For a server running Apache web server in a production environment,
# it is advisable to disable Server Signatures. These signatures displayed
# on error pages, and in other communications with the web server,
# may reveal sensitive information about the software versions running on the web server.
ServerSignature Off
# +-------------------------------------------------------------------------+
# SET YOUR DEVELOPMENT ENVIRONMENT
# +-------------------------------------------------------------------------+
# SetEnv, used in Apache's configuration (be it a .htaccess file,
# or a VirtualHost), defines an environment variable.
SetEnv APPLICATION_ENV production
# +-------------------------------------------------------------------------+
# DISABLE ETAGS:
# +-------------------------------------------------------------------------+
# First off let’s try to understand what ETAGs actually are. If you have ETAGs turned on for
# your site then each asset sent from your server to a client is sent with an ETAG in
# it’s header. For Apache this key is constructed from the files inode, size and last modified datetime.
# So what does the client actually do with an ETAG for a particular asset?
# If the client has the asset cached then the expire header of the asset is checked first to see
# if the server needs to be contacted at all. If the asset has not expired then the ETAG has no effect at all,
# the locally cached version will be used. If the asset has indeed expired then the client will send a request
# for the asset with the ETAG stored by the client to the server. The server performs a comparison between
# the ETAG of the asset and the ETAG sent by the client, if the ETAGs match then the server will
# return a 304 not modified header which instructs the browser to use it’s cached version of the asset.
# If they do not match the server will return the asset.
# As you might have deduced, if any of the properties that make up an ETAG for the assets web server change then a different
# ETAG will be generated which will force the users browser to re cache the file, this will only
# happen however if the clients cached version of the asset has expired though as noted above.
# So ETAGs will not magically force clients to re cache assets when you make changes to them.
#
# When ETAGs go bad
#
# So far ETAGs certainly sound like a useful tool for assets caching.
# Things aren’t so simple however due to an issue that arises when ETAGs are used in load balanced environments.
# As noted above for Apache (and for other web servers as well) an assets location on disk
# is taken into account when generating an ETAG, this includes information about the actual server that the file is located on.
# This means that in a load balanced environment each server will generate a different ETAG for the same file,
# making ETAGs pretty useless in such circumstances. This is the issue that causes a lot of people to
# disable ETAGs completely and opt for using cache control headers only for their assets.
#
# There is a suggested solution for this, and that involves removing the inode part from ETAGs entirely
# so they will be based on a files size and last modified time .
#
# But, to increase page loading speed, my advice is YSlow.
# perfect tool & Yslow recommends to use ETAGs instead of setting off.
Header unset Pragma
FileETAG None
Header unset ETAG
FileETag MTime Size
<ifmodule mod_expires.c>
<filesmatch "\.(jpg|gif|png|css|js)$">
ExpiresActive on
ExpiresDefault "access plus 1 year"
</filesmatch>
</ifmodule>
# +-------------------------------------------------------------------------+
# SET THE DEFAULT LANGUAGE
# +-------------------------------------------------------------------------+
# DefaultLanguage is intended for set the default language when a directory contains multiple language files,
# e.g.: index.html.en, index.html.fr. They need to be set with AddLanguage in Apache configuration somewhere:
#
# AddLanguage en .en
# AddLanguage fr .fr
#
# Files will these extensions will be delivered with the Content-Language HTTP header.
# If no extension is provided, can be a coincidence to have both methods generating the
# Content-Language header but if you want to explicitly set the document Content-Language may
# run slightly faster with explicit header definition, as it does not need to check the
# file extension and fallback to a default language if set.
DefaultLanguage en-US
# +-------------------------------------------------------------------------+
# SET THE DEFAULT CHARACTER SET
# +-------------------------------------------------------------------------+
# Setting charset information in .htaccess
# it is important to ensure that any information about character encoding sent by the server
# is correct, since information in the HTTP header overrides information in the document itself.
# AddCharset UTF-8 .html
# Many Apache servers are configured to send files using the ISO-8859-1 (Latin-1) encoding
AddDefaultCharset UTF-8
# +-------------------------------------------------------------------------+
# SET DEFAULT EXECUTED FILE
# +-------------------------------------------------------------------------+
# The directoryindex command allows you to specify a default page to display when a directory is accessed.
# For instance, if a visitor requests a directory on your web site, you can specify the
# file to load when the directory is accessed (if a filename is not specified in the initial request).
# For example, to display a 'index.html' file rather than showing directory listings or to
# load a 'index.php' file rather than an 'index.html' file.
#
# To set-up a directoryindex, create a .htaccess file following the main instructions
# and guidance which includes the following text:
DirectoryIndex index.php index.html
# +-------------------------------------------------------------------------+
# SET MODE RE-WRITE
# +-------------------------------------------------------------------------+
# The Apache module mod_rewrite allows you to rewrite URL requests that come into
# your server and is based on a regular-expression parser
RewriteEngine On
# +-------------------------------------------------------------------------+
# REDIRECT HTTP TRAFFIC TO HTTPS
# +-------------------------------------------------------------------------+
# if server has https vars
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{SERVER_NAME}%{REQUEST_URI} [R,L]
# if server dont have https vars, in case load balancing servers or proxy servers
# and you are getting redirect loop by above code
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R=302,L]
# +-------------------------------------------------------------------------+
# ENSURE - WWW IN URL
# +-------------------------------------------------------------------------+
# re direct url on www if not exist
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
# +-------------------------------------------------------------------------+
# REMOVE ALL QUERY STRING FROM URLS
# +-------------------------------------------------------------------------+
# remove all url query string fro url and clean them
RewriteCond %{QUERY_STRING} .
RewriteRule ^$ /? [R,L]
# +-------------------------------------------------------------------------+
# GET ALL REQUEST ON INDEX FILE
# +-------------------------------------------------------------------------+
# get all request on index file only
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule .* index.php/$0 [PT,L]
# +-------------------------------------------------------------------------+
# REWRITECOND: BAD FLAG DELIMITERS
# +-------------------------------------------------------------------------+
# block out any script that includes a <script> tag in url.
RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
# block out use of illegal or unsafe characters in the http request
RewriteCond %{THE_REQUEST} ^.*(\\r|\\n|%0A|%0D).* [NC,OR]
# block out use of illegal or unsafe characters in the referer variable of the http request
RewriteCond %{HTTP_REFERER} ^(.*)(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR]
# block out use of illegal or unsafe characters in any cookie associated with the http request
RewriteCond %{HTTP_COOKIE} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR]
# block out use of illegal characters in uri or use of malformed uri
RewriteCond %{REQUEST_URI} ^/(,|;|:|<|>|">|"<|/|\\\.\.\\).{0,9999}.* [NC,OR]
# block out use of illegal or unsafe characters in the query string variable
RewriteCond %{QUERY_STRING} ^.*(<|>|'|"|%0A|%0D|%27|%3C|%3E|%00|%20).* [NC]
# return 403 forbidden header and show the content of the root homepage
RewriteRule .* index.php [F]
# +-------------------------------------------------------------------------+
# PHP ENVIRONMENT SETUP
# +-------------------------------------------------------------------------+
# PHP Server Setup and Application Settings
# PHP Flags
php_flag display_startup_errors on
php_flag display_errors on
php_flag html_errors on
php_flag log_errors on
php_flag ignore_repeated_errors on
php_flag ignore_repeated_source on
php_flag report_memleaks on
php_flag track_errors on
# PHP Values
php_value docref_root 0
php_value docref_ext 0
php_value error_log %{DOCUMENT_ROOT}/logs/full_stack_error.log
php_value error_reporting -1
php_value log_errors_max_len 0
# +-------------------------------------------------------------------------+
# FORM POST AND UPLOAD SETTINGS
# +-------------------------------------------------------------------------+
php_value upload_max_filesize 128M
php_value post_max_size 128M
php_value max_input_time 3600
php_value max_execution_time 3600
# +-------------------------------------------------------------------------+
# SESSION COOKIES HTTP & SECURE FLAG
# +-------------------------------------------------------------------------+
php_value session.cookie_httponly on
php_value session.cookie_secure on
# +-------------------------------------------------------------------------+
# DELETE FILE EXTENSIONS
# +-------------------------------------------------------------------------+
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^([^\.]+)$ $1.php [NC,L]
# +-------------------------------------------------------------------------+
# ONLY ALLOW GET & POST REQUEST
# +-------------------------------------------------------------------------+
<LimitExcept GET POST>
Order Allow,Deny
Deny from all
</LimitExcept>
# +-------------------------------------------------------------------------+
# BLOCK ACCESS TO LOG FILE
# +-------------------------------------------------------------------------+
<files site_error.php>
Order allow,deny
Deny from all
</files>
# +-------------------------------------------------------------------------+
# BLOCK ACCESS TO MULTIPLE FILE TYPES
# +-------------------------------------------------------------------------+
<FilesMatch "\.(sql|bat|htaccess|htpasswd|ini|psd|log|sh|error|error|error|info|php_info|info_php|bkp|backup|src|exe|dll|src|msi|\.[hH][tT])$">
Order allow,deny
Deny from all
</FilesMatch>
# +-------------------------------------------------------------------------+
# DENY ACCESS TO ONE SPECIFIC FOLDER
# +-------------------------------------------------------------------------+
Deny from all
# +-------------------------------------------------------------------------+
# EXPIREATION SETTINGS
# +-------------------------------------------------------------------------+
<FilesMatch "\.(?i:gif|jpe?g|png|ico|css|js|swf|css|js|ico|pdf|jpg|jpeg|png|gif|html|htm|xml|txt|xsl|svg|ttf|otf)$">
<IfModule mod_headers.c>
Header set Cache-Control "max-age=2592000, public"
</IfModule>
</FilesMatch>
# +-------------------------------------------------------------------------+
# LEVERAGE BROWSER CACHING
# +-------------------------------------------------------------------------+
<IfModule mod_expires.c>
ExpiresActive On
ExpiresByType image/jpg "access 1 year"
ExpiresByType image/jpeg "access 1 year"
ExpiresByType image/gif "access 1 year"
ExpiresByType image/png "access 1 year"
ExpiresByType text/css "access 1 month"
ExpiresByType text/html "access 1 month"
ExpiresByType application/pdf "access 1 month"
ExpiresByType text/x-javascript "access 1 month"
ExpiresByType application/x-shockwave-flash "access 1 month"
ExpiresByType image/x-icon "access 1 year"
ExpiresDefault "access 1 month"
</IfModule>
<IfModule mod_headers.c>
<filesmatch "\.(ico|flv|jpg|jpeg|png|gif|css|swf)$">
Header set Cache-Control "max-age=2678400, public"
</filesmatch>
<filesmatch "\.(html|htm)$">
Header set Cache-Control "max-age=7200, private, must-revalidate"
</filesmatch>
<filesmatch "\.(pdf)$">
Header set Cache-Control "max-age=86400, public"
</filesmatch>
<filesmatch "\.(js)$">
Header set Cache-Control "max-age=2678400, private"
</filesmatch>
</IfModule>
<ifmodule mod_expires.c>
<Filesmatch "\.(jpg|jpeg|png|gif|js|css|swf|ico|woff|mp3)$">
ExpiresActive on
ExpiresDefault "access plus 2 days"
</Filesmatch>
</ifmodule>
# +-------------------------------------------------------------------------+
# HTTP Strict Transport Security (HSTS) header
# +-------------------------------------------------------------------------+
# HSTS is an acronym for HTTP Strict Transport Security
# It is a security enhancement which ensures only secure pages from your domain are shown by a browser
# Automatically redirects HTTP requests to HTTPS for the target domain
# Does not allow a user to override the invalid certificate message
# Enabled through the use of a special response header
# Can be preloaded via browsers by listing your domain
<IfModule mod_headers.c>
Header set Strict-Transport-Security "max-age=10886400; includeSubDomains; preload" env=HTTPS
<FilesMatch "\.(css|gif|ico|jpeg|jpg|js|png|woff)$">
Header unset Strict-Transport-Security
</FilesMatch>
</IfModule>
# +-------------------------------------------------------------------------+
# BLOCK IFRAME CALL
# +-------------------------------------------------------------------------+
# The X-Frame-Options HTTP response header can be used to indicate whether or not a browser
# should be allowed to render a page in a <frame> or <iframe>. This can be used to
# avoid clickjacking attacks, by ensuring that your content is not embedded into other sites
<IfModule mod_headers.c>
Header set X-Frame-Options "SAMEORIGIN"
</IfModule>
# +-------------------------------------------------------------------------+
# SECURITY HEADERS - X-CONTENT-TYPE: NOSNIFF
# +-------------------------------------------------------------------------+
<IfModule mod_headers.c>
Header set X-Content-Type-Options "nosniff"
</IfModule>
# +-------------------------------------------------------------------------+
# HTTP HEADER X-XSS-PROTECTION
# +-------------------------------------------------------------------------+
<IfModule mod_headers.c>
Header append X-XSS-Protection: "1; mode=block;"
</IfModule>
# +-------------------------------------------------------------------------+
# Avoid HTTP method
# +-------------------------------------------------------------------------+
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS)
RewriteRule ^ - [F]