Guide to the use of .htaccess for seo, redirects, urls, content crawl
Search engine optimizations (SEO) is all about making your website search engine friendly and help rank pages or posts. In this competitive market, you just cannot ignore SEO. .Htaccess is one of the important files of your website that lets you control your website functionality and how it interacts with the web. Thats why you need to customize it to maximize not only control but also search engine optimization. With the use of .htaccess for SEO, you can override the server configuration with your requirement.
Htaccess How To
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 |
# Apache configuration file # httpd.apache.org/docs/2.2/mod/quickreference.html # Note .htaccess files are an overhead, this logic should be in your Apache # config if possible: httpd.apache.org/docs/2.2/howto/htaccess.html # # ---------------------------------------------------------------------- # Default Lang and Basic Security Behavior # ---------------------------------------------------------------------- # X-Powered-By hidden by default nobody will notice if you're using PHP or whatever Header unset X-Powered-By # Set by default UTF-8 charset AddDefaultCharset UTF-8 # Don not allow any pages to be framed - Defends against CSRF Header set X-Frame-Options SAMEORIGIN # Turn on IE8-IE9 XSS prevention tools Header set X-XSS-Protection "1; mode=block" # Only allow JavaScript from the same domain to be run. # Don not allow inline JavaScript to run. Header set X-Content-Security-Policy "allow 'self';" # Prevent mime based attacks Header set X-Content-Type-Options "nosniff" # Disable server sign ServerSignature Off # drop Range header when more than 5 ranges. CVE-2011-3192 SetEnvIf Range (,.*?){5,} bad-range=1 RequestHeader unset Range env=bad-range # LIMIT UPLOAD FILE SIZE TO PROTECT AGAINST DOS ATTACK. Bytes, 0-2147483647(2GB) LimitRequestBody 2147483647 # ---------------------------------------------------------------------- # Better website experience for IE users. # ---------------------------------------------------------------------- # Force the latest IE version, in various cases when it may fall back to IE7 mode # futher details: github.com/rails/rails/commit/123eb25#commitcomment-118920 # Use ChromeFrame if it's installed for a better experience for the poor IE folks <IfModule mod_headers.c> Header set X-UA-Compatible "IE=Edge,chrome=1" # mod_headers cannnot match by content-type, but we don't want to send this header on *everything*... <FilesMatch "\.(js|css|gif|png|jpe?g|pdf|xml|oga|ogg|m4a|ogv|mp4|m4v|webm|svg|svgz|eot|ttf|otf|woff|ico|webp|appcache|manifest|htc|crx|oex|xpi|safariextz|vcf)$" > Header unset X-UA-Compatible </FilesMatch> # Header set P3P "policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"" # OR THIS, SIMPLER # Header set P3P "policyref="/w3c/p3p.xml"" </IfModule> # # ---------------------------------------------------------------------- # Cross-domain AJAX requests, ENABLE CSRF first (see above) # ---------------------------------------------------------------------- # Serve cross-domain Ajax requests, disabled by default. Enable-cors.org # code.google.com/p/html5security/wiki/CrossOriginRequestSecurity # <IfModule mod_headers.c> # Header set Access-Control-Allow-Origin "*" # </IfModule> # # # ---------------------------------------------------------------------- # CORS-enabled images (@crossorigin) # ---------------------------------------------------------------------- # Send CORS headers if browsers request them; enabled by default for images. # futher details: # - developer.mozilla.org/en/CORS_Enabled_Image # - blog.chromium.org/2011/07/using-cross-domain-images-in-webgl-and.html # - hacks.mozilla.org/2011/11/using-cors-to-load-webgl-textures-from-cross-domain-images/ # - wiki.mozilla.org/Security/Reviews/crossoriginAttribute <IfModule mod_setenvif.c> <IfModule mod_headers.c> # mod_headers, y u no match by Content-Type?! <FilesMatch "\.(gif|png|jpe?g|svg|svgz|ico|webp)$"> SetEnvIf Origin ":" IS_CORS Header set Access-Control-Allow-Origin "*" env=IS_CORS </FilesMatch> </IfModule> </IfModule> # # # ---------------------------------------------------------------------- # Webfont access # ---------------------------------------------------------------------- # Allow access from all domains for webfonts.Alternatively you could only whitelist your # subdomains like "subdomain.example.com". <IfModule mod_headers.c> <FilesMatch "\.(ttf|ttc|otf|eot|woff|font.css)$"> Header set Access-Control-Allow-Origin "*" </FilesMatch> </IfModule> # # # ---------------------------------------------------------------------- # Proper MIME type for all files # ---------------------------------------------------------------------- # JavaScript # Normalize to standard type (it is sniffed in IE anyways) # futher details: tools.ietf.org/html/rfc4329#section-7.2 AddType application/javascript js jsonp AddType application/json json # # Audio # AddType audio/ogg oga ogg AddType audio/mp4 m4a f4a f4b # # Video # AddType video/ogg ogv AddType video/mp4 mp4 m4v f4v f4p AddType video/webm webm AddType video/x-flv flv # # SVG # Required for svg webfonts on iPad # futher details: twitter.com/FontSquirrel/status/14855840545 # AddType image/svg+xml svg svgz AddEncoding gzip svgz # # Webfonts # AddType application/vnd.ms-fontobject eot AddType application/x-font-ttf ttf ttc AddType font/opentype otf AddType application/x-font-woff woff # # Assorted types # AddType image/x-icon ico AddType image/webp webp AddType text/cache-manifest appcache manifest AddType text/x-component htc AddType application/xml rss atom xml rdf AddType application/x-chrome-extension crx AddType application/x-opera-extension oex AddType application/x-xpinstall xpi AddType application/octet-stream safariextz AddType application/x-web-app-manifest+json webapp AddType text/x-vcard vcf AddType application/x-shockwave-flash swf AddType text/vtt vtt # # # ---------------------------------------------------------------------- # Allow concatenation from within specific js and css files # ---------------------------------------------------------------------- # e.g. Inside of script.combined.js you could have # <!--#include file="libs/jquery-1.5.0.min.js" --> # <!--#include file="plugins/jquery.idletimer.js" --> # and they would be included into this single file. # This is not in use in the boilerplate as it stands. You may # choose to use this technique if you do not have a build process. #<FilesMatch "\.combined\.js$"> # Options +Includes # AddOutputFilterByType INCLUDES application/javascript application/json # SetOutputFilter INCLUDES #</FilesMatch> #<FilesMatch "\.combined\.css$"> # Options +Includes # AddOutputFilterByType INCLUDES text/css # SetOutputFilter INCLUDES #</FilesMatch> # # # ---------------------------------------------------------------------- # Gzip compression # ---------------------------------------------------------------------- <IfModule mod_gzip.c> mod_gzip_on Yes mod_gzip_dechunk Yes mod_gzip_item_include file .(html?|txt|css|js|php|pl)$ mod_gzip_item_include handler ^cgi-script$ mod_gzip_item_include mime ^text/.* mod_gzip_item_include mime ^application/x-javascript.* mod_gzip_item_exclude mime ^image/.* mod_gzip_item_exclude rspheader ^Content-Encoding:.*gzip.* </IfModule> <IfModule mod_deflate.c> # Force deflate for mangled headers developer.yahoo.com/blogs/ydn/posts/2010/12/pushing-beyond-gzipping/ <IfModule mod_setenvif.c> <IfModule mod_headers.c> SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding </IfModule> </IfModule> # Compress all output labeled with one of the following MIME-types <IfModule mod_filter.c> AddOutputFilterByType DEFLATE application/atom+xml \ application/javascript \ application/json \ application/rss+xml \ application/vnd.ms-fontobject \ application/x-font-ttf \ application/xhtml+xml \ application/xml \ font/opentype \ image/svg+xml \ image/x-icon \ text/css \ text/html \ text/plain \ text/x-component \ text/xml </IfModule> </IfModule> # # # ---------------------------------------------------------------------- # Expires headers (for better cache control) # ---------------------------------------------------------------------- # These are pretty far-future expires headers. # They assume you control versioning with filename-based cache busting # Additionally, consider that outdated proxies may miscache # futher details: www.stevesouders.com/blog/2008/08/23/revving-filenames-dont-use-querystring/ # If you don nott use filenames to version, lower the CSS and JS to something like "access plus 1 week". # 1 YEAR - does not change often <FilesMatch "\.(flv|ico|pdf|avi|mov|ppt|doc|mp3|wmv|wav)$"> ExpiresDefault A29030400 </FilesMatch> <IfModule mod_expires.c> ExpiresActive on # # Perhaps better to whitelist expires rules? Perhaps. # ExpiresDefault "access plus 1 month" # # cache.appcache needs re-requests in FF 3.6 (thanks Remy ~Introducing HTML5) # ExpiresByType text/cache-manifest "access plus 0 seconds" # # Your document html # ExpiresByType text/html "access plus 0 seconds" # # Data # ExpiresByType text/xml "access plus 0 seconds" ExpiresByType application/xml "access plus 0 seconds" ExpiresByType application/json "access plus 0 seconds" # # Feed # ExpiresByType application/rss+xml "access plus 1 hour" ExpiresByType application/atom+xml "access plus 1 hour" # # Favicon (cannot be renamed) # ExpiresByType image/x-icon "access plus 1 month" # # Media: images, video, audio # ExpiresByType image/gif "access plus 1 month" ExpiresByType image/png "access plus 1 month" ExpiresByType image/jpeg "access plus 1 month" ExpiresByType video/ogg "access plus 1 month" ExpiresByType audio/ogg "access plus 1 month" ExpiresByType video/mp4 "access plus 1 month" ExpiresByType video/webm "access plus 1 month" # # HTC files (css3pie) # ExpiresByType text/x-component "access plus 1 month" # # Webfonts # ExpiresByType application/x-font-ttf "access plus 1 month" ExpiresByType font/opentype "access plus 1 month" ExpiresByType application/x-font-woff "access plus 1 month" ExpiresByType image/svg+xml "access plus 1 month" ExpiresByType application/vnd.ms-fontobject "access plus 1 month" # # CSS and JavaScript # ExpiresByType text/css "access plus 1 year" ExpiresByType application/javascript "access plus 1 year" </IfModule> # # # ---------------------------------------------------------------------- # Prevent mobile network providers from modifying your site # ---------------------------------------------------------------------- # The following header prevents modification of your code over 3G on some # European providers. # This is the official 'bypass' suggested by O2 in the UK. <IfModule mod_headers.c> Header set Cache-Control "no-transform" </IfModule> # # # ---------------------------------------------------------------------- # ETag removal # ---------------------------------------------------------------------- # FileETag None is not enough for every server. <IfModule mod_headers.c> Header unset ETag </IfModule> # Since we are sending far-future expires, we don not need ETags for # static content. # futher details: developer.yahoo.com/performance/rules.html#etags FileETag None # # # ---------------------------------------------------------------------- # Stop screen flicker in IE on CSS rollovers # ---------------------------------------------------------------------- # The following directives stop screen flicker in IE on CSS rollovers - in # combination with the "ExpiresByType" rules for images (see above). BrowserMatch "MSIE" brokenvary=1 BrowserMatch "Mozilla/4.[0-9]{2}" brokenvary=1 BrowserMatch "Opera" !brokenvary SetEnvIf brokenvary 1 force-no-vary # # # ---------------------------------------------------------------------- # Set Keep-Alive Header # ---------------------------------------------------------------------- # Keep-Alive allows the server to send multiple requests through one # TCP-connection. Be aware of possible disadvantages of this setting. Turn on # if you serve a lot of static content. <IfModule mod_headers.c> Header set Connection Keep-Alive </IfModule> # # # ---------------------------------------------------------------------- # Cookie setting from iframes # ---------------------------------------------------------------------- # Allow cookies to be set from iframes (for IE only) # If needed, specify a path or regex in the Location directive. # <IfModule mod_headers.c> # Header set P3P "policyref=\"/w3c/p3p.xml\", CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\"" # </IfModule> # # # ---------------------------------------------------------------------- # Start rewrite engine # ---------------------------------------------------------------------- # Turning on the rewrite engine is necessary for the following rules and # features. FollowSymLinks must be enabled for this to work. # Some cloud hosting services require RewriteBase to be set: goo.gl/HOcPN # If using the h5bp in a subdirectory, use `RewriteBase /foo` instead where # 'foo' is your directory. # If your web host does not allow the FollowSymlinks option, you may need to # comment it out and use `Options +SymLinksIfOwnerMatch`, but be aware of the # performance impact: http://goo.gl/Mluzd <IfModule mod_rewrite.c> RewriteEngine On Options +FollowSymlinks RewriteBase / # ## Force public directory for the rood of websites ## # Change ptsource.github to be your primary domain. # RewriteCond %{HTTP_HOST} ^(www.)?ptsource.github$ # # Change 'subfolder' to be the folder you will use for your primary domain. # RewriteCond %{REQUEST_URI} !^/repositories/ # # Do not change this line. # RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d # # Change 'subfolder' to be the folder you will use for your primary domain. # RewriteRule ^(.*)$ /repositories/$1 # Change ptsource.github to be your primary domain again. # Change 'subfolder' to be the folder you will use for your primary domain # followed by / then the main file for your site, index.php, index.html, etc. RewriteCond %{HTTP_HOST} ^(www.)?ptsource.github$ RewriteRule ^(.*)$ http://ptsource.github/$1 [R,L] # ## Remove Extensions ## # change the .php extension with whatever you need # RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_FILENAME}\.php -f RewriteRule ^(.*)$ $1.php # ## Remove Bad Bots from crawling ## # IF THE UA STARTS WITH THESE # Block spambots # RewriteCond %{HTTP_USER_AGENT} ^(aesop_com_spiderman|alexibot|backweb|bandit|batchftp|bigfoot) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(black.?hole|blackwidow|blowfish|botalot|buddy|builtbottough|bullseye) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(cheesebot|cherrypicker|chinaclaw|collector|copier|copyrightcheck) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(cosmos|crescent|curl|custo|da|diibot|disco|dittospyder|dragonfly) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(drip|easydl|ebingbong|ecatch|eirgrabber|emailcollector|emailsiphon) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(emailwolf|erocrawler|exabot|eyenetie|filehound|flashget|flunky) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(frontpage|getright|getweb|go.?zilla|go-ahead-got-it|gotit|grabnet) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(grafula|harvest|hloader|hmview|httplib|httrack|humanlinks|ilsebot) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(infonavirobot|infotekies|intelliseek|interget|iria|jennybot|jetcar) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(joc|justview|jyxobot|kenjin|keyword|larbin|leechftp|lexibot|lftp|libweb) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(likse|linkscan|linkwalker|lnspiderguy|lwp|magnet|mag-net|markwatch) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(mata.?hari|memo|microsoft.?url|midown.?tool|miixpc|mirror|missigua) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(mister.?pix|moget|mozilla.?newt|nameprotect|navroad|backdoorbot|nearsite) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(net.?vampire|netants|netcraft|netmechanic|netspider|nextgensearchbot) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(attach|nicerspro|nimblecrawler|npbot|octopus|offline.?explorer) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(offline.?navigator|openfind|outfoxbot|pagegrabber|papa|pavuk) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(pcbrowser|php.?version.?tracker|pockey|propowerbot|prowebwalker) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(psbot|pump|queryn|recorder|realdownload|reaper|reget|true_robot) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(repomonkey|rma|internetseer|sitesnagger|siphon|slysearch|smartdownload) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(snake|snapbot|snoopy|sogou|spacebison|spankbot|spanner|sqworm|superbot) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(superhttp|surfbot|asterias|suzuran|szukacz|takeout|teleport) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(telesoft|the.?intraformant|thenomad|tighttwatbot|titan|urldispatcher) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(turingos|turnitinbot|urly.?warning|vacuum|vci|voideye|whacker) [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(libwww-perl|widow|wisenutbot|wwwoffle|xaldon|xenu|zeus|zyborg|anonymouse) [NC,OR] # ## STARTS WITH WEB # RewriteCond %{HTTP_USER_AGENT} ^web(zip|emaile|enhancer|fetch|go.?is|auto|bandit|clip|copier|master|reaper|sauger|site.?quester|whack) [NC,OR] # ## ANYWHERE IN UA -- GREEDY REGEX # RewriteCond %{HTTP_USER_AGENT} ^.*(craftbot|download|extract|stripper|sucker|ninja|clshttp|webspider|leacher|collector|grabber|webpictures).*$ [NC] # ## ISSUE 403 / SERVE ERRORDOCUMENT # RewriteRule . - [F,L] # ## Useragents starting with # RewriteCond %{HTTP_USER_AGENT} ^atraxbot [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^Azureus [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^geohasher [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^PycURL [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^Python-urllib [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^research-scan-bot [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^Sosospider [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^Wget [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^xenu [NC,OR] # ## User agents contains string # RewriteCond %{HTTP_USER_AGENT} ^.*casper [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^.*goblox [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^.*sun4u [NC] RewriteRule ^(.*)$ - [F] # ## Disable blank UA ## Blank UA and Referer # RewriteCond %{HTTP_REFERER} ^$ [NC] RewriteCond %{HTTP_USER_AGENT} ^$ [NC] RewriteRule .* - [F,L] # ## Prevent use of specified methods in HTTP Request # RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK) [NC,OR] # ## Block out use of illegal or unsafe characters in the HTTP Request # RewriteCond %{THE_REQUEST} ^.*(\\r|\\n|%0A|%0D).* [NC,OR] # ## Block out use of illegal or unsafe characters in the Referer Variable of the HTTP Request ## RewriteCond %{HTTP_REFERER} ^(.*)(<|>|'|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR] ## Block out use of illegal or unsafe characters in any cookie associated with the HTTP Request # RewriteCond %{HTTP_COOKIE} ^.*(<|>|'|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR] # ## Block out use of illegal characters in URI or use of malformed URI # RewriteCond %{REQUEST_URI} ^/(,|;|:|<|>|">|"<|/|\\\.\.\\).{0,9999}.* [NC,OR] # ## Block out use of empty User Agent Strings ## NOTE - disable this rule if your site is integrated with Payment Gateways such as PayPal ## RewriteCond %{HTTP_USER_AGENT} ^$ [OR] ## Block out use of illegal or unsafe characters in the User Agent variable # RewriteCond %{HTTP_USER_AGENT} ^.*(<|>|'|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR] # ## Measures to block out SQL injection attacks # RewriteCond %{QUERY_STRING} ^.*(;|<|>|'|"|"|'|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|cast|set|declare|drop|update|md5|benchmark).* [NC,OR] # ## Block out reference to localhost/loopback/127.0.0.1 in the Query String # RewriteCond %{QUERY_STRING} ^.*(localhost|loopback|127\.0\.0\.1).* [NC,OR] # ## Block out use of illegal or unsafe characters in the Query String variable # RewriteCond %{QUERY_STRING} ^.*(<|>|'|'|%0A|%0D|%27|%3C|%3E|%00).* [NC] # ########## Begin - File injection protection, by SigSiu.net RewriteCond %{REQUEST_METHOD} GET RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=http:// [OR] RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=(\.\.//?)+ [OR] RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ [NC] RewriteRule .* - [F] ########## End - File injection protection # RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=http%3A%2F%2F [OR] # # proc/self/environ? no way! # RewriteCond %{QUERY_STRING} proc\/self\/environ [NC,OR] # ## PHP-CGI Vulnerability # RewriteCond %{QUERY_STRING} ^(%2d|\-)[^=]+$ [NC] RewriteRule (.*) - [F,L] </IfModule> # # # ---------------------------------------------------------------------- # Suppress or force the "www." at the beginning of URLs # ---------------------------------------------------------------------- # The same content should never be available under two different URLs - # especially not with and without "www." at the beginning, since this can cause # SEO problems (duplicate content). That is why you should choose one of the # alternatives and redirect the other one. # By default option 1 (no "www.") is activated. # no-www.org/faq.php?q=class_b # If you would prefer to use option 2, just comment out all option 1 lines # and uncomment option 2. # IMPORTANT: NEVER USE BOTH RULES AT THE SAME TIME! # ---------------------------------------------------------------------- # Option 1: # Rewrite "www.example.com -> example.com". #<IfModule mod_rewrite.c> # RewriteCond %{HTTPS} !=on # RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC] # RewriteRule ^ http://%1%{REQUEST_URI} [R=301,L] #</IfModule> # ---------------------------------------------------------------------- # Option 2: # Rewrite "example.com -> www.example.com". # Be aware that the following rule might not be a good idea if you use "real" # subdomains for certain parts of your website. <IfModule mod_rewrite.c> RewriteCond %{HTTPS} !=on RewriteCond %{HTTP_HOST} !^www\..+$ [NC] RewriteRule ^ http://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L] </IfModule> # # # ---------------------------------------------------------------------- # Built-in filename-based cache busting # ---------------------------------------------------------------------- # If you are not using the build script to manage your filename version revving, # you might want to consider enabling this, which will route requests for # `/css/style.20110203.css` to `/css/style.css`. # To understand why this is important and a better idea than all.css?v1231, # please refer to the bundled documentation about `.htaccess`. # <IfModule mod_rewrite.c> # RewriteCond %{REQUEST_FILENAME} !-f # RewriteCond %{REQUEST_FILENAME} !-d # RewriteRule ^(.+)\.(\d+)\.(js|css|png|jpg|gif)$ $1.$3 [L] # </IfModule> # # # ---------------------------------------------------------------------- # Prevent SSL cert warnings # ---------------------------------------------------------------------- # Rewrite secure requests properly to prevent SSL cert warnings, e.g. prevent # https://www.example.com when your cert only allows https://secure.example.com # <IfModule mod_rewrite.c> # RewriteCond %{SERVER_PORT} !^443 # RewriteRule ^ https://example-domain-please-change-me.com%{REQUEST_URI} [R=301,L] # </IfModule> # # # ---------------------------------------------------------------------- # Prevent 404 errors for non-existing redirected folders # ---------------------------------------------------------------------- # without -MultiViews, Apache will give a 404 for a rewrite if a folder of the # same name does not exist. # webmasterworld.com/apache/3808792.htm Options -MultiViews # # # ---------------------------------------------------------------------- # Custom Errors page # ---------------------------------------------------------------------- # You can add custom pages to handle 500 or 403 pretty easily, if you like. # If you are hosting your site in subdirectory, adjust this accordingly # e.g. ErrorDocument 404 /subdir/404.html ErrorDocument 100 /100_CONTINUE ErrorDocument 101 /101_SWITCHING_PROTOCOLS ErrorDocument 102 /102_PROCESSING ErrorDocument 200 /200_OK ErrorDocument 201 /201_CREATED ErrorDocument 202 /202_ACCEPTED ErrorDocument 203 /203_NON_AUTHORITATIVE ErrorDocument 204 /204_NO_CONTENT ErrorDocument 205 /205_RESET_CONTENT ErrorDocument 206 /206_PARTIAL_CONTENT ErrorDocument 207 /207_MULTI_STATUS ErrorDocument 300 /300_MULTIPLE_CHOICES ErrorDocument 301 /301_MOVED_PERMANENTLY ErrorDocument 302 /302_MOVED_TEMPORARILY ErrorDocument 303 /303_SEE_OTHER ErrorDocument 304 /304_NOT_MODIFIED ErrorDocument 305 /305_USE_PROXY ErrorDocument 307 /307_TEMPORARY_REDIRECT ErrorDocument 400 /400_BAD_REQUEST ErrorDocument 401 /401_UNAUTHORIZED ErrorDocument 402 /402_PAYMENT_REQUIRED ErrorDocument 403 /403_FORBIDDEN ErrorDocument 404 /404_NOT_FOUND ErrorDocument 405 /405_METHOD_NOT_ALLOWED ErrorDocument 406 /406_NOT_ACCEPTABLE ErrorDocument 407 /407_PROXY_AUTHENTICATION_REQUIRED ErrorDocument 408 /408_REQUEST_TIME_OUT ErrorDocument 409 /409_CONFLICT ErrorDocument 410 /410_GONE ErrorDocument 411 /411_LENGTH_REQUIRED ErrorDocument 412 /412_PRECONDITION_FAILED ErrorDocument 413 /413_REQUEST_ENTITY_TOO_LARGE ErrorDocument 414 /414_REQUEST_URI_TOO_LARGE ErrorDocument 415 /415_UNSUPPORTED_MEDIA_TYPE ErrorDocument 416 /416_RANGE_NOT_SATISFIABLE ErrorDocument 417 /417_EXPECTATION_FAILED ErrorDocument 422 /422_UNPROCESSABLE_ENTITY ErrorDocument 423 /423_LOCKED ErrorDocument 424 /424_FAILED_DEPENDENCY ErrorDocument 426 /426_UPGRADE_REQUIRED ErrorDocument 500 /500_INTERNAL_SERVER_ERROR ErrorDocument 501 /501_NOT_IMPLEMENTED ErrorDocument 502 /502_BAD_GATEWAY ErrorDocument 503 /503_SERVICE_UNAVAILABLE ErrorDocument 504 /504_GATEWAY_TIME_OUT ErrorDocument 505 /505_VERSION_NOT_SUPPORTED ErrorDocument 506 /506_VARIANT_ALSO_VARIES ErrorDocument 507 /507_INSUFFICIENT_STORAGE ErrorDocument 510 /510_NOT_EXTENDED # # # ---------------------------------------------------------------------- # A little more security # ---------------------------------------------------------------------- # To avoid displaying the exact version number of Apache being used, add the # following to httpd.conf (it will not work in .htaccess): # ServerTokens Prod IndexIgnore * # "-Indexes" will have Apache block users from browsing folders without a # default document Usually you should leave this activated, because you # should not allow everybody to surf through every folder on your server (which # includes rather private places like CMS system folders). <IfModule mod_autoindex.c> Options -Indexes Options -ExecCGI </IfModule> # Block access to "hidden" directories or files whose names begin with a # period. This includes directories used by version control systems such as # Subversion or Git. <IfModule mod_rewrite.c> RewriteCond %{SCRIPT_FILENAME} -d [OR] RewriteCond %{SCRIPT_FILENAME} -f RewriteRule "(^|/)\." - [F] </IfModule> # Block access to backup and source files. These files may be left by some # text/html editors and pose a great security danger, when anyone can access # them. <FilesMatch "(\.(bak|config|sql|fla|psd|ini|log|sh|inc|swp|dist)|~)$"> Order allow,deny Deny from all Satisfy All </FilesMatch> AddHandler cgi-script .pl .py .asp .shtml .sh .cgi # optional logging. # CustomLog insert-path-and-name-of-log common env=bad-range # If your server is not already configured as such, the following directive # should be uncommented in order to set PHP is register_globals option to OFF. # This closes a major security hole that is abused by most XSS (cross-site # scripting) attacks. For more information: http://php.net/register_globals # # --------------------------------------------------------------- # PHP DEDICATED RULES # DO NOT USE THEM IF YOU DON'T USE PHP # --------------------------------------------------------------- # IF REGISTER_GLOBALS DIRECTIVE CAUSES 500 INTERNAL SERVER ERRORS: # # Your server does not allow PHP directives to be set via .htaccess. In that # case you must make this change in your php.ini file instead. If you are # using a commercial web host, contact the administrators for assistance in # doing this. Not all servers allow local php.ini files, and they should # include all PHP configurations (not just this one), or you will effectively # reset everything to PHP defaults. Consult www.php.net for more detailed # information about setting PHP directives. # php_flag register_globals Off # Rename session cookie to something else, than PHPSESSID # php_value session.name XGOSID # Disable magic quotes (This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.0.) # php_flag magic_quotes_gpc Off # Do not show you are using PHP # Note: Move this line to php.ini since it wont work in .htaccess # php_flag expose_php Off # Level of log detail - log all errors # php_value error_reporting -1 # Write errors to log file # php_flag log_errors On # Do not display errors in <span class="mark">browser</span> (production - Off, development - On) # php_flag display_errors Off # Do not display startup errors (production - Off, development - On) # php_flag display_startup_errors Off # Format errors in plain text # Note: Leave this setting 'On' for xdebug is var_dump() output # php_flag html_errors Off # Show multiple occurrence of error # php_flag ignore_repeated_errors Off # Show same errors from different sources # php_flag ignore_repeated_source Off # Size limit for error messages # php_value log_errors_max_len 1024 # Don not precede error with string (does not accept empty string, use whitespace if you need) # php_value error_prepend_string " " # Don not prepend to error (does not accept empty string, use whitespace if you need) # php_value error_append_string " " |