Almost Perfect htaccess File for WordPress Blogs
If you manage and edit your own website or run a blog with it’s own domain then you are probably aware of a type of file called the .htaccess file. You may or may not know what this file actually does, or how to create and edit one but fret not, I’m here to help.
Josiah Cole dot com runs a slightly out of date WordPress 2.1 install (the horror I know), and a fairly standard one at that, with a couple select plugins like Askimet and wp-cache to help me possibly survive another Digging. The one item that is not lacking is a complete and robust .htaccess file that sufficiently protects and aids my site in handling traffic and visitors.
This quick tutorial will provide you with an htaccess file that does the following:
1. Protects itself (security)
2. Turns the digital signature off (security)
3. Limits upload size (security)
4. Protects wp-config.php (security)
5. Gives access permission to all visitors with exceptions (security, usability)
6. Specifies custom error documents (usability)
7. Disables directory browsing (security)
8. Redirect old pages to new (optional)
9. Disables image hotlinking (bandwidth)
10. Enables PHP compression (bandwidth)
11. Sets the canonical or “standard” url for your site (seo, usability)
1. Step 1, create a blank .htaccess file. This can be done in Notepad or a comparable simple text editor of your choice (no MS Word does not count although it’s possible). Open Notepad and Click Save, name this file htaccess.txt. If you’re using Windows XP the OS won’t allow you to name a file e .htaccess but don’t worry, you can rename it once it’s been uploaded to your server (no idea how Linux, Vista or OSX handle this).
2. Add content to htaccess.txt. Now that you have htaccess.txt saved, you can start to edit the file and use it to better manage your site without relying on complex PHP or bloated JavaScript code.
The example htaccess file below is one that can be used for a website like this one (running WordPress and nothing else), simply un-comment the sections you’d like to use by removing the # at the beginning of the line and copy+paste the contents into your own .htaccess file.
# protect the htaccess file
<files .htaccess>
order allow,deny
deny from all
</files>
# disable the server signature
ServerSignature Off
# limit file uploads to 10mb
LimitRequestBody 10240000
# protect wpconfig.php
<files wp-config.php>
order allow,deny
deny from all
</files>
#who has access who doesnt
order allow,deny
#deny from 000.000.000.000
allow from all
#custom error docs
ErrorDocument 404 /notfound.php
ErrorDocument 403 /forbidden.php
ErrorDocument 500 /error.php
# disable directory browsing
Options All -Indexes
#redirect old to new
Redirect 301 /old.php http://www.yourdomain.com/new.php
#block referring domains
RewriteEngine on
RewriteCond %{HTTP_REFERER} digg\.com [NC]
RewriteRule .* – [F]
#disable hotlinking of images with forbidden or custom image option
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?yourdomain.com/.*$ [NC]
#RewriteRule \.(gif|jpg)$ – [F]
#RewriteRule \.(gif|jpg)$ http://www.yourdomain.com/stealingisbad.gif [R,L]
# php compression – use with caution
<ifmodule mod_php4.c>
php_value zlib.output_compression 16386
</ifmodule>
# set the canonical url
RewriteEngine On
RewriteCond %{HTTP_HOST} ^yourdomain\.com$ [NC]
RewriteRule ^(.*)$ http://www.yourdomain.com/$1 [R=301,L]
# protect from spam comments
RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} .wp-comments-post\.php*
RewriteCond %{HTTP_REFERER} !.*yourdomain.com.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule (.*) ^http://%{REMOTE_ADDR}/$ [R=301,L]
3. Upload htaccess.txt. Once you’ve created your master piece of an .htaccess file upload the htaccess.txt file to your web server via ftp (in ASCII mode) and rename the file to .htaccess. Once it’s been renamed change the file permissions of the .htaccess file to 644 to further protect it from malicious hacker types.
4. Test, Test, Test. Go to your site, is it still up? Good, now check to see if you can access files you protected, or try and see a directory listing. Not all variables are testable but do your best to make sure your file is working.
Lastly Josiah Cole dot com is now running a variation of the htaccess file above with no hotlink protection (I only host a couple images) and no redirects or custom errors docs (yet). No problems *yet* but I’m still running tests to make sure there are no problems. Maybe my visitors can help me do this by commenting? If I like it I’ll add your suggestion to the article and give you some URL lovin’.
Note: If you are already using a custom permalink structure to format page names, you’ll need to keep that code in the htaccess file in order for that to continue functioning. To see your htaccess file in WordPress click Manage>Files>.htaccess (for rewrite rules).
53 Comments »
RSS feed for comments on this post. TrackBack URI
Leave a comment
You must be logged in to post a comment.
[...] posted a clean and concise htaccess file example for website’s running WordPress Blogs. This htaccess file tutorial covers 11 techniques to increase security, decrease bandwidth and control user access all [...]
[...] Cole dot com about htaccess file creation specifically for sites running WordPress blogs. The htaccess file tutorial covers twelve main items that increase security and give you complete control over your [...]
[...] Link to Article linux Almost Perfect htaccess File for WordPress Blogs » Posted at Josiah Cole [...]
Nice clean and helpful article Josiah.. There are a couple code examples in particular that I think would help you over on my blog.. Check out theUltimate htaccess tutorial.. I especially like the “For Webmasters” chapter.
Here’s code you could use to deny access only when it’s 4pm
# If the hour is 16 (4 PM) Then deny all access
RewriteCond %{TIME_HOUR} ^16$
RewriteRule ^.*$ - [F,L]
[...] July 17, 2007: Josiah Cole gives a detailed explanation of how to create a .htaccess file that will help you secure your site, and aid the site in handling traffic and visitors. His [...]
Hi! I just wanted to thank you for your clear and thorough explanation about the “perfect” .htaccess.
I would also like to add that if you run into trouble (403 errors while trying to post or edit pages), you can add the following to the .htaccess file
SecFilterInheritance Off
It drove me crazy during several days. I hope it helps somebody….
Iván
[...] doing a bit of research, I ran across this posting by Josiah [...]
[...] perfecto .htaccess para WordPress [eng]www.josiahcole.com/2007/07/11/almost-perfect-htaccess-file-f… por beku76 hace pocos segundos [...]
[...] learn more about utilizing you .haccess for wordpress, check Josiah Cole’s post about have an almost perfect htaccess file for WordPress. He lists over 10 directives that you [...]
[...] Josaiah Cole has written a nice .htaccess guide on harderning wordpress here. [...]
[...] Almost Perfect htaccess File for WordPress Blogs [...]
[...] Beskyt med .htaccess: Du kan bruge .htaccess til at password-beskytte visse dele af din side, blokere adgang fra visse IP adresser, blokere for hot-linking af billeder og meget andet. Ls mere her, og en WordPress specifik .htaccess guide kan findes her. [...]
[...] this article saved my day added by mpty at 09:23 pm to notes – [...]
[...] Almost Perfect htaccess File for WordPress Blogs [...]
[...] is another useful .htaccess reference for WordPress [...]
[...] terminal on OSX, or a programme like Putty on Windows]. You’ll also need to confirm that your .htaccess file rules and permalinks structure are replicated in the new install. Likely too, you’ll [...]
Thanks for the code how can I use this for a sub folder ie mysite.com/blog
Mike
[...] Almost Perfect htaccess File for WordPress Blogs | Josiah Cole dot com [...]
[...] Josiah Cole Dot Com – Published 7-11-07 [...]
[...] Almost Perfect htaccess File for WordPress Blogs | Josiah Cole dot com (tags: htaccess wordpress apache) [...]
[...] Almost Perfect htaccess File for WordPress Blogs [...]
[...] indicate that the attack failed. I follow WordPress security best practices, and have a well-hardened .htaccess policy file. This kind of thing is [...]
[...] a. Almost Perfect htaccess File for WordPress Blogs [...]
[...] Almost Perfect htaccess File for WordPress Blogs (tags: wordpress security blog .htaccess howto webdev via:ohskylab) [...]
[...] Source – Josiah Cole [...]
[...] tilgang til mappestrukturen din. Hvis du kjenner til .htaccess, sjekk ut denne innføringen i hvordan beskytte WordPress best mulig med .htaccess. Sjekk også denne [...]
[...] Source – Josiah Cole [...]
[...] after super heros or cartoon characters, get used to it). Last night I was fooling around with some WordPress htaccess hacks, and apparently the Apache webserver did not enjoy what I was doing. This morning [...]
[...] Source: Josiahcole [...]
[...] Source: Josiahcole [...]
[...] 来源 – Josiah Cole [...]
[...] Source [...]
[...] that could help you understand more about what .htaccess does, and how do you tweak your settings (learn more). Some of the stuff you can learn in the article is: This quick tutorial will provide you with an [...]
[...] Source: Josiahcole [...]
[...] Almost Perfect htaccess File for WordPress Blogs [...]
[...] http://www.josiahcole.com/2007/07/11/almost-perfect-htaccess-file-for-wordpress-blogs/ [...]
[...] http://www.josiahcole.com/2007/07/11/almost-perfect-htaccess-file-for-wordpress-blogs/ , que o autor passa o pente fino no htaccess para incrementar a proteção e, [...]
[...] Almost Perfect HTAccess File for WordPress Blogs – Used this as a reference for constructing my htaccess file. AKPC_IDS += "812,"; [...]
[...] http://www.josiahcole.com/2007/07/11/almost-perfect-htaccess-file-for-wordpress-blogs/ « « Previous Post: Oracle freshens its VirtualBox Next Post: Mozilla Developer Preview (Number 4) Now Available » » [...]
[...] 来源 – Josiah Cole [...]
[...] you get over that problem.More security steps that can be done through htaccess file, here are some 11 more steps that you can use.Jeff Starr has created wonderful instructions for securing servers via htaccess [...]
[...] tilgang til mappestrukturen din. Hvis du kjenner til .htaccess, sjekk ut denne innføringen i hvordan beskytte WordPress best mulig med .htaccess. Sjekk også denne [...]
[...] in creating a more robust .htaccess file for your site (and know more about coding than I do), this guy has a tutorial. Otherwise, hope you’re not too [...]
[...] The almost perfect htacces for wordpress by Josiah Cole. [...]
[...] The Almost Perfect htaccess File for WordPress Blogs by Josiah Cole [...]
[...] permalink -6.304632 106.826999 [...]
[...] nice web host with the best support imaginable, it mattered. Check out Josiah Cole's 'almost-perfect .htaccess file' for WordPress and change all the yourdomainhere.com elements to, well, your domain name before [...]
[...] Protect content with .htaccess: You can use “.htaccess” files to password protect one or more parts of your site, block certain IP addresses, block “hot-linking” of images and lots more. Read more here. A WordPress-specific .htaccess guide can be found here. [...]
[...] – Hardening WordPress JosiahCole.com – Almost Perfect htaccess File for WordPress Blogs This entry was posted in WordPress. Bookmark the permalink. ← Another Banned iPhone 4 [...]
[...] Ingat !! Ganti yourdomain.com dengan domain Anda. Sedangkan stealigisbad.gif dapat Anda ganti sesuai gambar yang Anda upload ke root directory. Dimana kode terakhir menunjukkan gambar stealingisbad.gif yang merupakan sebuah gambar yang muncul jika ada blog lain yang mencoba mengambil gambar Anda. Cara lain untuk melakukannya adalah melalui cPanel. Jika Anda menggunakan hosting dengan cPanel ini jauh lebih mudah karena CPanel Anda terdapat pilihan yang disebut Hotlink Protection. Perhatikan pengaturan Hotlink Protection seperti pada gambar di bawah ini: Ingat Anda harus membiarkan feed Anda jika pembaca feed Anda tidak akan melihat gambar. Source: Josiahcole [...]
[...] and sources not previously cited: Reuben Yau Josiah Cole WP [...]
[...] Yau Josiah Cole WP [...]
[...] If you don’t understand, you can read this other article for detailed instructions. http://www.josiahcole.com/2007/07/11/almost-perfect-htaccess-file-for-wordpress-blogs/ [...]