{"id":11,"date":"2007-09-28T14:49:48","date_gmt":"2007-09-28T07:49:48","guid":{"rendered":"http:\/\/blog.whplus.com\/2007\/09\/28\/using-htaccess-to-secure-and-improve-wordpress.html"},"modified":"2019-03-21T10:50:40","modified_gmt":"2019-03-21T03:50:40","slug":"using-htaccess-to-secure-and-improve-wordpress","status":"publish","type":"post","link":"https:\/\/www.whplus.com\/blog\/2007\/09\/28\/using-htaccess-to-secure-and-improve-wordpress.html","title":{"rendered":"Using .htaccess to Secure and improve WordPress"},"content":{"rendered":"<p>Although .htaccess is only a file, it can change settings on the servers and allow you to do many different things, the most popular being able to have your own custom 404 error pages. .htaccess isn\u2019t difficult to use and is really just made up of a few simple instructions in a text file. Nevertheless, it can greatly improve your site\u2019s security, so there\u2019s almost no excuse in using it.Creating a .htaccess file may cause you a few problems. Writing the file is easy, you just need enter the appropriate code into a text editor. You may run into problems with saving the file. Because .htaccess is a strange file name (the file actually has no name but a 8 letter file extension) it may not be accepted on certain systems (e.g. Windows 95). With most operating systems, though, all you need to do is to save the file by entering the name as: .htaccess\u201d (including the quotes). If this doesn\u2019t work, you will need to name it something else (e.g. htaccess.txt) and then upload it to the server. Once you have uploaded the file you can then rename it using an FTP program.<\/p>\n<p>Although there are many things you can do with an .htaccess file, this post will focus on securing WordPress, the CMS used to write articles and posts on this site.<\/p>\n<ol>\n<li>Protect the .htaccess itself (security). This prevents users from reading\/writing the file and hence, changing security settings.<br \/>\n<em> &lt;files .htaccess&gt;<br \/>\norder allow,deny<br \/>\ndeny from all<br \/>\n&lt;\/files&gt;<\/em><\/li>\n<li>Hide the Server\u2019s digital signature off (security). This hides the server signature, so intruders will have a harder time trying to find security holes, since they don\u2019t know what\u2019s behind the server.<br \/>\n<em>ServerSignature Off<\/em><\/li>\n<li>Limit file upload size. This helps to prevent DoS attacks (users uploading huge files that may crash the server) and saves bandwidth.<br \/>\n<em> LimitRequestBody 10240000<br \/>\n# limit file uploads to 10mb<\/em><\/li>\n<li>Disable mod_security filtering. This is an optional setting and must be handled with care. This directive tells the server not to use mod_security\u2019s filters, which, for instance won\u2019t allow users to post a text with the words \u201ccurl\u201d, \u201clynx\u201d or \u201cwget\u201d in them. While this might seem trivial, it can be a headache in a site like this one, where these words are typed almost on a daily basis.<br \/>\n<em> SecFilterInheritance Off<\/em><\/li>\n<li>Protect wp-config.php. Just as with .htaccess, we prevent users from reading\/writing WordPress\u2019 configuration main configuration file. This directive assumes WordPress is setup on the site\u2019s root folder.<br \/>\n<em>&lt;files wp-config.php&gt;<br \/>\norder allow,deny<br \/>\ndeny from all<br \/>\n&lt;\/files&gt;<br \/>\n<\/em><\/li>\n<li>Specify custom error documents. This directives have to do with site usability rather than security. They determine which pages will be displayed in case of server errors, such a Page not Found (code 404), Forbidden access (code 403), etc.<br \/>\n<em>#custom error docs<br \/>\nErrorDocument 404 \/notfound.php<br \/>\nErrorDocument 403 \/forbidden.php<br \/>\nErrorDocument 500 \/error.php<\/em><\/li>\n<li>Disable directory browsing. This prevents the server from displaying folder contents when no index file (index.html, index.php, etc.) is found. This prevents users from seeing the folder contents and makes it harder to mount an attack against the site.<br \/>\n<em># disable directory browsing<br \/>\nOptions All -Indexes<\/em><\/li>\n<li>Disable Image hotlinking. This prevents other sites from linking to our site\u2019s images, forcing them to either point to the entire page or host the image somewhere else. This saves precious bandwidth and may increase traffic (just a tiny bit). The code below will display image <em>stealingisbad.gif <\/em>whenever someone tries to display our images by hotlinking to our site.<br \/>\n<em>#disable hotlinking of images<br \/>\nRewriteEngine on<br \/>\nRewriteCond %{HTTP_REFERER} !^$<br \/>\nRewriteCond %{HTTP_REFERER} !^http:\/\/(www\\.)?yourdomain.com\/.*$ [NC]<br \/>\n#RewriteRule \\.(gif|jpg|png)$ http:\/\/www.yourdomain.com\/stealingisbad.gif [R,L]<\/em><\/li>\n<li>Sets the canonical or \u201cstandard\u201d for every URL at your site. This helps improving the site\u2019s usability and also helps in improving the site\u2019s Search Engine rankings. In short, it redirects all requests of the form: <em>http:\/\/yourdomain.com<\/em> to <em>http:\/\/www.yourdomain.com\/.<\/em><br \/>\n<em># set the canonical url<br \/>\nRewriteEngine On<br \/>\nRewriteCond %{HTTP_HOST} ^yourdomain\\.com$ [NC]<br \/>\nRewriteRule ^(.*)$ http:\/\/www.yourdomain.com\/$1 [R=301,L]<\/em><\/li>\n<li>Protect the blog from Spam comments (and spam form submission in general). This last directives will prevent users from posting forms (such as comment forms) directly from other sites. Although this is hardly a catch-all antispam measure, it helps.<em><br \/>\n# protect from spam comments<br \/>\nRewriteEngine On<br \/>\nRewriteCond %{REQUEST_METHOD} POST<br \/>\nRewriteCond %{REQUEST_URI} .wp-comments-post\\.php*<br \/>\nRewriteCond %{HTTP_REFERER} !.*yourdomain.com.* [OR]<br \/>\nRewriteCond %{HTTP_USER_AGENT} ^$<br \/>\nRewriteRule (.*) ^http:\/\/%{REMOTE_ADDR}\/$ [R=301,L]<\/em><\/li>\n<\/ol>\n<p>After these directives, you should add whatever WordPress writes for managing Permalinks. There are much more directives left and many more ways to use this little file to improve and secure a website but this should account for most of the everyday needs. After you upload the file to your server, test, test, test and when you think everything\u2019s working fine\u2026 test again. Check whether \u201cprotected\u201d files can be accessed and that you can still access \u201callowed\u201d files and folders. Regular expressions can be a tricky thing, and they can lead to seemingly random problems, so make sure you test your site thoroughly before releasing it to a production server.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Although .htaccess is only a file, it can change settings on the servers and allow you to do many different things, the most popular being able to have your own custom 404 error pages. .htaccess isn\u2019t difficult to use and is really just made up of a few simple instructions in a text file. Nevertheless,\u2026 <span class=\"read-more\"><a href=\"https:\/\/www.whplus.com\/blog\/2007\/09\/28\/using-htaccess-to-secure-and-improve-wordpress.html\">Read More &raquo;<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-11","post","type-post","status-publish","format-standard","hentry","category-tutorial"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.whplus.com\/blog\/wp-json\/wp\/v2\/posts\/11","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.whplus.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.whplus.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.whplus.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.whplus.com\/blog\/wp-json\/wp\/v2\/comments?post=11"}],"version-history":[{"count":2,"href":"https:\/\/www.whplus.com\/blog\/wp-json\/wp\/v2\/posts\/11\/revisions"}],"predecessor-version":[{"id":1131,"href":"https:\/\/www.whplus.com\/blog\/wp-json\/wp\/v2\/posts\/11\/revisions\/1131"}],"wp:attachment":[{"href":"https:\/\/www.whplus.com\/blog\/wp-json\/wp\/v2\/media?parent=11"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.whplus.com\/blog\/wp-json\/wp\/v2\/categories?post=11"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.whplus.com\/blog\/wp-json\/wp\/v2\/tags?post=11"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}