Ht access for Public Files

[jamo32]

I am running a old version of os with all the security patches, what would be the best htaccess for public files be has anyone an example.

 

Many thanks

[MrPhil]

It will often depend on your specific server's setup, so I hesitate to offer specific code. That said, you want to have your "admin" directory tree (which you've of course renamed to something unguessable) under password protection. Your hosting control panel should have a command to do that. Beyond, that, turn off indexing (Options -Index, I think) so that if someone browses to (say) your image directory, they won't be shown a list of your files. Deny access to .htaccess and php.ini files (so no one can read them through their browser). Deny access by IP address to ill-mannered bots and to spammers or hackers causing you problems. Add "hotlink protection" to your image and document files (easiest through your hosting control panel). If you have SEO (modified URLs), the .htaccess will usually have code to convert them back into normal URLs. You may want to turn off "mod security" if it's enabled and it's causing any problems for you.

 

Note that if your site is correctly set up, with osC (and any other major applications) in their own subdirectories, the top level /.htaccess should not have anything specific to osC in it. That stuff goes in /shop/.htaccess. If you don't have a landing page /index.*, your /.htaccess will need to "URL rewrite" to automatically jump visitors entering at the root / to /shop.

 

Of course, all of this depends on your site running on an Apache server. It's all different for a Windows Server/IIS.