2
\$\begingroup\$

This is the current .htaccess configuration for one of the website projects that I am working on, just as a learning exercise. This is working code and everything in it seems to be ok, My hosting company helped me set up alot of these rules, While others where taken from various different blog posts. I'm looking to get feedback or reviews to see whether it is correct or whether it can be improved as I am still learning I don't expect it to be 100% acurate.

Some of the comments are just for my own understanding and learning purposes. Is anything missing or incorrect? Should everything be inside an IfModule?

        <IfModule mod_deflate.c>
                      SetOutputFilter DEFLATE
        <IfModule mod_setenvif.c>
               # Netscape 4.x has some problems...
                  BrowserMatch ^Mozilla/4 gzip-only-text/html
               # Netscape 4.06-4.08 have some more problems
                  BrowserMatch ^Mozilla/4\.0[678] no-gzip
                  BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html
               # MSIE masquerades as Netscape, but it is fine
               # BrowserMatch \bMSIE !no-gzip !gzip-only-text/html

               # NOTE: Due to a bug in mod_setenvif up to Apache 2.0.48
               # the above regex won't work. You can use the following
               # workaround to get the desired effect:

               # Don't compress images
                 SetEnvIfNoCase Request_URI .(?:gif|jpe?g|png)$ no-gzip dont-vary
        </IfModule>

        <IfModule mod_headers.c>
               # Make sure proxies don't deliver the wrong content
            Header always set Content-Security-Policy: upgrade-insecure-requests 
            Header set Strict-Transport-Security "max-age=122112887284; includeSubDomains; preload"
            Header append Vary User-Agent env=!dont-vary
            Header always append X-Frame-Options SAMEORIGIN
            Header set X-XSS-Protection "1; mode=block"
            Header set X-Content-Type-Options nosniff
            Header set Access-Control-Allow-Origin "*"
             IndexIgnore *.zip *.css *.php *.js *.pyt    
             Options -MultiViews -Indexes        

        </IfModule>

        # I'm guessing the code I added below reffers to cache storage either locally or on host/server Please check this.
        # Haven't set up any rules for Cache storage yet Add this... 

        <IfModule mod_expires.c>
           ExpiresActive On
           ExpiresDefault "access plus 6 hours"        
           ExpiresByType image/jpg "access plus 1 year"
           ExpiresByType image/jpeg "access plus 1 year"
           ExpiresByType image/gif "access plus 1 year"
           ExpiresByType image/png "access plus 1 year"
           ExpiresByType image/svg "access plus 1 year"
           ExpiresByType image/ani "access plus 1 year"
           ExpiresByType image/cur "access plus 1 year"
           ExpiresByType text/css "access plus 6 months"
           ExpiresByType image/html "access plus 4 hours"
           ExpiresByType image/x-icon "access plus 2 year"
           ExpiresByType application/pdf "access plus 2 months"
           ExpiresByType text/javascript "access plus 2 hours"
       </IfModule>
            # Added from :: https://www.youtube.com/watch?v=FEflwAIlLmg
            # Loading Ok with the Above code............ 
    </IfModule>

        # Prevent viewing of .htaccess file Same source as above

        #   <Files .htaccess>                   This part is throwing a server error... 
        #       order allow, deny
        #       deny from all
        #   </Files>

The Above code block is my Old .htAccess file, I let my Hosting run out and they've deleted the whole entire project +2 others which was months worth of work and research. I've now written out a new .htaccess file for which the code is included below. If anyone could review it for me & let me know if there are any mistakes, security issues, syntax errors or parts that could be optimized I would be hugely greatfull.

ServerSignature Off
DirectoryIndex coming-soon.html

         IndexIgnore *.bat *.css *.info *.zip *.js *.pyt *.txt *.py *.shtml   
              Options +FollowSymLinks -MultiViews -Indexes -ExecCGI   
    AddDefaultCharset utf-8
    AddCharset utf-8 .atom .css .js .json .rss .vtt .xml .txt .html .php .svg .shtml .py .pyt

    <IfModule mod_headers.c>
           # Make sure proxies don't deliver the wrong content
        Header always set Content-Security-Policy: upgrade-insecure-requests 

        Header set Strict-Transport-Security "max-age=122112887284;
             # includeSubDomains; preload"
        Header append Vary User-Agent env=!dont-vary
        Header always append X-Frame-Options SAMEORIGIN
        Header set X-XSS-Protection "1; mode=block"
        Header set X-Content-Type-Options nosniff
        # Header expect-CT: enforce, max-age=21600
        # Header set Access-Control-Allow-Origin "*"
              <FilesMatch "\.(ttf|otf|eot|woff|woff2|font.css|ico|webp)$">
                Header set Access-Control-Allow-Origin "*"
              </FilesMatch>
              <filesMatch "\\.(ico|pdf|flv|jpg|jpeg|png|gif|swf)$">
                Header set Cache-Control "max-age=2592000, public"
              </filesMatch>
                     #No access to the .htaccess und .htpasswd
              <FilesMatch "(\.htaccess|\.htpasswd)">
                Order deny,allow
                Deny from all
              </FilesMatch>
              <files install.php>
                Order allow,deny
                Deny from all
              </files>            
              <filesMatch "\\.(css)$">
                Header set Cache-Control "max-age=2592000, public"
              </filesMatch>

              <filesMatch "\\.(js)$">
                Header set Cache-Control "max-age=216000, private, must-revalidate"
              </filesMatch>

              <filesMatch "\\.(xml|txt)$">
                Header set Cache-Control "max-age=216000, public, must-revalidate"
              </filesMatch>

              <filesMatch "\\.(html|htm|php)$">
                Header set Cache-Control "max-age=1, private, must-revalidate"
              </filesMatch>
                # No access to the readme.html
              <files readme.html>
                Order Allow,Deny
                Deny from all
                Satisfy all
              </Files>              
    </IfModule>

    <IfModule mod_setenvif.c>
           # Netscape 4.x has some problems...
              BrowserMatch ^Mozilla/4 gzip-only-text/html
           # Netscape 4.06-4.08 have some more problems
              BrowserMatch ^Mozilla/4\.0[678] no-gzip
              BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html
           # MSIE masquerades as Netscape, but it is fine
           # BrowserMatch \bMSIE !no-gzip !gzip-only-text/html

           # NOTE: Due to a bug in mod_setenvif up to Apache 2.0.48
           # the above regex won't work. You can use the following
           # workaround to get the desired effect:

           # Don't compress images
             SetEnvIfNoCase Request_URI .(?:gif|jpe?g|png)$ no-gzip dont-vary
    </IfModule>

    <IfModule mod_expires.c>
       ExpiresActive On
       ExpiresDefault "access plus 6 hours"        
       ExpiresByType image/jpg "access plus 1 year"
       ExpiresByType image/jpeg "access plus 1 year"
       ExpiresByType image/gif "access plus 1 year"
       ExpiresByType image/png "access plus 1 year"
       ExpiresByType image/svg "access plus 1 year"
       ExpiresByType image/ani "access plus 1 year"
       ExpiresByType image/cur "access plus 1 year"
       ExpiresByType text/css "access plus 6 months"
       ExpiresByType image/html "access plus 4 hours"
       ExpiresByType image/x-icon "access plus 2 year"
       ExpiresByType application/pdf "access plus 2 months"
       ExpiresByType text/javascript "access plus 3 hours"
    </IfModule>

    <IfModule mod_rewrite.c>
        RewriteEngine On
          RewriteBase /
        RewriteCond %{QUERY_STRING} (eval\() [NC,OR]
        RewriteCond %{QUERY_STRING} (127\.0\.0\.1) [NC,OR]
        RewriteCond %{QUERY_STRING} ([a-z0-9]{2000,}) [NC,OR]
        RewriteCond %{QUERY_STRING} (javascript:)(.*)(;) [NC,OR]
        RewriteCond %{QUERY_STRING} (base64_encode)(.*)(\() [NC,OR]
        RewriteCond %{QUERY_STRING} (GLOBALS|REQUEST)(=|\[|%) [NC,OR]
        RewriteCond %{QUERY_STRING} (<|%3C)(.*)script(.*)(>|%3) [NC,OR]
        RewriteCond %{QUERY_STRING} (\\|\.\.\.|\.\./|~|`|<|>|\|) [NC,OR]
        RewriteCond %{QUERY_STRING} (boot\.ini|etc/passwd|self/environ) [NC,OR]
        RewriteCond %{QUERY_STRING} (thumbs?(_editor|open)?|tim(thumb)?)\.php [NC,OR]
        RewriteCond %{QUERY_STRING} (\'|\")(.*)(drop|insert|md5|select|union) [NC]
        RewriteRule .* - [F]
    </IfModule>
        # 6G:[REQUEST METHOD]
    <IfModule mod_rewrite.c>
        RewriteCond %{REQUEST_METHOD} ^(connect|debug|move|put|trace|track) [NC]
        RewriteRule .* - [F]
    </IfModule>
       # 6G:[REFERRERS]
    <IfModule mod_rewrite.c>
        RewriteCond %{HTTP_REFERER} ([a-z0-9]{2000,}) [NC,OR]
        RewriteCond %{HTTP_REFERER} (semalt.com|todaperfeita) [NC]
        RewriteRule .* - [F]
    </IfModule>
       # 6G:[REQUEST STRINGS]
    <IfModule mod_alias.c>
        RedirectMatch 403 (?i)([a-z0-9]{2000,})
        RedirectMatch 403 (?i)(https?|ftp|php):/
        RedirectMatch 403 (?i)(base64_encode)(.*)(\()
        RedirectMatch 403 (?i)(=\\\'|=\\%27|/\\\'/?)\.
        RedirectMatch 403 (?i)/(\$(\&)?|\*|\"|\.|,|&|&amp;?)/?$
        RedirectMatch 403 (?i)(\{0\}|\(/\(|\.\.\.|\+\+\+|\\\"\\\")
        RedirectMatch 403 (?i)(~|`|<|>|:|;|,|%|\\|\{|\}|\[|\]|\|)
        RedirectMatch 403 (?i)/(=|\$&|_mm|cgi-|muieblack)
	    RedirectMatch 403 (?i)(&pws=0|_vti_|\(null\)|\{\$itemURL\}|echo(.*)kae|etc/passwd|eval\(|self/environ)
        RedirectMatch 403 (?i)\.(aspx?|bash|bak?|cfg|cgi|dll|exe|git|hg|ini|jsp|log|mdb|out|sql|svn|swp|tar|rar|rdf)$
        RedirectMatch 403 (?i)/(^$|(wp-)?config|mobiquo|phpinfo|shell|sqlpatch|thumb|thumb_editor|thumbopen|timthumb|webshell)\.php
    </IfModule>
    <ifModule mod_gzip.c>
        mod_gzip_on Yes
        mod_gzip_dechunk Yes
        mod_gzip_item_include file \.(html?|txt|css|js|php|pl)$
        mod_gzip_item_include handler ^cgi-script$
        mod_gzip_item_include mime ^text/.*
        mod_gzip_item_include mime ^application/x-javascript.*
        mod_gzip_item_exclude mime ^image/.*
        mod_gzip_item_exclude rspheader ^Content-Encoding:.*gzip.*
    </ifModule>    
    <IfModule mod_rewrite.c>
        RewriteEngine on
            RewriteCond %{REQUEST_FILENAME} !-f
            RewriteCond %{REQUEST_FILENAME} !-d
            RewriteRule ^(.*)$ /coming-soon.html [NC,L,QSA]
    </IfModule>     
    <IfModule mod_deflate.c>
          # SetOutputFilter DEFLATE
    </IfModule>    
          # MIME Types         ...>[Some of these are redundant & will never be used in My Application Only include the ones you wish to use.]
    <IfModule mod_mime.c>
        # ::>>. Text/Plain Text
          AddType text/plain .txt
          AddType text/xml .xml
          AddType text/xsl .xsl
          AddType text/xsd .xsd
          AddType text/css .css
          AddType text/x-js .js4
          AddType text/javascript .js3
          AddType text/x-component .htc
          AddType text/html .html .shtml .htm
          AddType text/richtext .rtf .rtx
        # ::>>. Images
          AddType image/png .png
          AddType image/bmp .bmp
          AddType image/gif .gif
          AddType image/x-icon .ico
          AddType image/tiff .tif .tiff
          AddType image/svg+xml .svg .svgz
          AddType image/jpeg .jpg .jpeg .jpe
        # ::>>. Audio
          AddType audio/wav .wav
          AddType audio/wma .wma
          AddType video/avi .avi
          AddType audio/ogg .ogg
          AddType video/divx .divx
          AddType video/mp4 .mp4 .m4v
          AddType audio/mpeg .mp3 .m4a
          AddType audio/midi .mid .midi
          AddType audio/x-realaudio .ra .ram
        # ::>>. Video
          AddType video/quicktime .mov .qt
          AddType video/mpeg .mpeg .mpg .mpe
          AddType video/asf .asf .asx .wax .wmv .wmx
        # ::>>. Applications
          AddType application/zip .zip
          AddType application/pdf .pdf
          AddType application/x-tar .tar
          AddType application/json .json
          AddType application/java .class
          AddType application/x-font-otf .otf
          AddType application/font-woff .woff
          AddType application/x-gzip .gz .gzip
          AddType application/x-font-ttf .ttf .ttc
          AddType application/x-javascript .js
          AddType application/javascript .js2
          AddType application/msword .doc .docx
          AddType application/x-msdownload .exe
          AddType application/vnd.ms-write .wri
          AddType application/vnd.ms-access .mdb
          AddType application/vnd.ms-project .mpp
          AddType application/vnd.ms-opentype .otf
          AddType application/vnd.ms-fontobject .eot
          AddType application/x-shockwave-flash .swf
          AddType application/vnd.ms-opentype .ttf .ttc
          AddType application/vnd.oasis.opendocument.text .odt
          AddType application/vnd.oasis.opendocument.chart .odc
          AddType application/vnd.oasis.opendocument.formula .odf
          AddType application/vnd.oasis.opendocument.graphics .odg
          AddType application/vnd.oasis.opendocument.database .odb
          AddType application/vnd.oasis.opendocument.presentation .odp
          AddType application/vnd.oasis.opendocument.spreadsheet .ods
          AddType application/vnd.ms-powerpoint .pot .pps .ppt .pptx
          AddType application/vnd.ms-excel .xla .xls .xlsx .xlt .xlw
    </IfModule> 

the backticks in the RewriteCond match seem to be messing up the syntax highlighting on Code review, but theres not much I can do about that.

Thanks in advanced for anyone viewing or commenting on this post.

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.