HostSEO Blog

Stories and News from IT Industry, Reviews & Tips | Technology Blog


How to set up internal protection for .htaccess

  • Category : cPanel Question
  • Posted on : Mar 03, 2020
  • Views : 1,416
  • By : HostSEO

This part is applicable only for cases when you wish to manually set up all the necessary settings and rules. All these settings can be set up automatically with secure plugins (especially BulletProof Security). We recommend using the secure plugins first and only if they fail to deliver necessary control, perform manual configuration. If you do need to make specific changes to the .htaccess file manually, kindly use the guide provided below:

.htaccess (hypertext access) is the default name of the directory-level configuration file specific for web servers running Apache.

This is a file which is modified the most often when dealing with redirects and is also often used to change file types to make them executable. It is also the one you will be using to harden your environment.

To protect it, apply a few simple rules – set low permissions and deny access.

Apply Low Permissions

The basic guidance for permissions is simple: the lower the number, the harder the access becomes. Good rule of thumb is to keep the number as low as possible where the performance or functionality is not impacted. For most users, setting it to 640 will grant the level of access that you need.

Add .HTACCESS Directives

What’s important to note here is that this only works if the attack is external. This won’t protect you from internal attacks (if an entire cPanel account is hacked, for example)
This is the .htaccess directive you can use:

#PROTECT HTACCESS

Order Allow, Deny
Deny from all

Note: This only protects the file from external access.

  • Disable directory browsing

If you do not want to allow your visitors to browse through your entire directory, simply add the piece of 2 lines in your .htaccess in the root directory of your WordPress blog:

# disable directory browsing
Options All -Indexes

  • wp-config file protection

Wp-config.php is important because it contains all the sensitive data and configuration of your blog and therefore, it should be locked through .htaccess. Add the code below to the .htaccess file in the root directory:

# protect wpconfig.php

order allow,deny
deny from all

The code denies access to the wp-config.php file to everyone.

  • Access to wp-content directory

Wp-content contains all content for your WordPress installation. This is a very important folder and it should be secured. Users should be only able to view and access certain file types like images (jpg, gif, png), Javascript, css and XML.
Place the code below in the .htaccess file within the wp-content folder (not the root):

Order deny,allow
Deny from all

Allow from all

  • wp-admin files

Wp-admin should be accessed only by you and your fellow bloggers (if any). You may use .htaccess to restrict access and allow only specific IP addresses to this directory.
If you have a static IP address and you always blog from your computer, this can be a good option for you. However, if you run a multiple user blog, then either you can opt out of it or you can allow access from a range of IPs.

Copy and paste the code below into the .htaccess in the wp-admin folder (not the root folder):

# deny access to wp admin
order deny,allow
allow from xx.xx.xx.xx # This is your static IP
deny from all

The above code will prevent the browser from accessing any file in these directories other than “xx.xx.xx.xx” which should be your static IP address.

  • Prevent script injection

To protect your WordPress blog from script injection and unwanted modification of _REQUEST and/or GLOBALS, copy and paste the code below into your .htaccess in the root:

# protect from sql injection
Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]

That's it!

Subscribe Now

10,000 successful online businessmen like to have our content directly delivered to their inbox. Subscribe to our newsletter!

Archive Calendar

SatSunMonTueWedThuFri
 123456
78910111213
14151617181920
21222324252627
28293031 

Born in 2004 ... Trusted By Clients n' Experts

SEO Stars

They never made me feel silly for asking questions. Help me understand how to attract more people and improve my search engine ranking.

Read More

Emily Schneller Manager at Sabre Inc
SEO Stars

Took advantage of Hostseo's superb tech support and I must say, it is a very perfect one. It is very fast, servers reliability is incredible.

Read More

Leena Mäkinen Creative producer
SEO Stars

We're operating a worldwide network of servers with high quality standards requirements, we’ve choose hostseo to be our perfect partner.

Read More

Ziff Davis CEO at Mashable
SEO Stars

It’s very comfortable to know I can rely about all technical issues on Hostseo and mostly that my website and emails are safe and secured here.

Read More

Isaac H. Entrepreneur
SEO Stars

With hostseo as a hosting partner we are more flexible and save money due to the better packages with great pricing, free SEO n' free SSL too!

Read More

Madeline E. Internet Professional