{"id":12,"date":"2007-10-02T14:58:45","date_gmt":"2007-10-02T07:58:45","guid":{"rendered":"http:\/\/blog.whplus.com\/2007\/09\/28\/how-do-i-protect-joomla-site-using-htaccess-and-mod_rewrite.html"},"modified":"2008-03-10T09:52:04","modified_gmt":"2008-03-10T02:52:04","slug":"how-do-i-protect-joomla-site-using-htaccess-and-mod_rewrite","status":"publish","type":"post","link":"https:\/\/www.whplus.com\/blog\/2007\/10\/02\/how-do-i-protect-joomla-site-using-htaccess-and-mod_rewrite.html","title":{"rendered":"How do I protect joomla site using .htaccess and mod_rewrite?"},"content":{"rendered":"

Introduction<\/strong>
\nSomeone has created a set of mod_rewrite conditions (below) that you can tag onto the end of your .htaccess file. These conditions will block a good number of common exploit attempts while interferring as little as possible with legitimate usage.<\/p>\n

Each server configuration is unique. If you are forwarded to your home page and receive a 403 Forbidden error, you will know these settings worked incorrectly on your site. If a particular rule breaks some feature of your site, just comment it out by placing a # in front of the offending rule.<\/p>\n

Note: <\/strong>As of Joomla! version 1.0.11, these settings are included in the file, htaccess.txt<\/em> (no dot in filename) which is automatically added to your site during the Joomla! install.<\/p>\n

Directions<\/strong>
\n1. Append the following code to the .htaccess<\/em> file in the same directory as your Joomla! index.php<\/em> file (often your public_html<\/em> directory).
\n2. Test your site.
\n3. If the site produces errors, comment out all of these lines, and uncomment and test one line at a time until you find the problem directive(s).
\n4. Try to tweak these directives to work on your server, or leave them commented out.<\/p>\n

########## Begin – Rewrite rules to block out some common exploits
\n#
\n# Block out any script trying to set a mosConfig value through the URL
\nRewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\\%3D) [OR]
\n# Block out any script trying to base64_encode crap to send via URL
\nRewriteCond %{QUERY_STRING} base64_encode.*\\(.*\\) [OR]
\n# Block out any script that includes a tag in URL
\nRewriteCond %{QUERY_STRING} (\\<|%3C).*script.*(\\>|%3E) [NC,OR]
\n# Block out any script trying to set a PHP GLOBALS variable via URL
\nRewriteCond %{QUERY_STRING} GLOBALS(=|\\[|\\%[0-9A-Z]{0,2}) [OR]
\n# Block out any script trying to modify a _REQUEST variable via URL
\nRewriteCond %{QUERY_STRING} _REQUEST(=|\\[|\\%[0-9A-Z]{0,2})
\n# Send all blocked request to homepage with 403 Forbidden error!
\nRewriteRule ^(.*)$ index.php [F,L]
\n#
\n########## End – Rewrite rules to block out some common exploits<\/p>\n","protected":false},"excerpt":{"rendered":"

Introduction Someone has created a set of mod_rewrite conditions (below) that you can tag onto the end of your .htaccess file. These conditions will block a good number of common exploit attempts while interferring as little as possible with legitimate usage. Each server configuration is unique. If you are forwarded to your home page and\u2026 Read More »<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-12","post","type-post","status-publish","format-standard","hentry","category-tutorial"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t