Posts Tagged ‘htaccess’

How to secure your Apache web server

I have wamp installed on my local PC with static IP. As I use it for development, sometimes I am sending the customers links to applications, to check and feedback them.

A problem I experienced is that Google indexed 2 files on my PC. How he did that remains a mistery for me, but for sure this is a HUGE security problem, databases and important mails got public. So, how did I solve the problem? I created a .htaccess file like this:

Allow from xx.xxx.xxx.xxx
Deny from all
AuthUserFile c:\wamp\pwds\.htpasswd
AuthName “Members Only”
AuthType Basic
require valid-user
What the above means:
1. I am now filtering the visitors based on their IP address. Right now only my IP is enabled, the rest will get an Access Forbidden error message.
2. Secondly, for the IPs enabled, there is a username-password combination which needs to be known. They are set in the .htpasswd file, something like:
username:password

.htaccess regular expressions cheat-sheet

It’s always good to have the most used htaccess regular expressions in one place. Here is a little help (cheat-sheet), which contains all the special characters which you can use in your htaccess file to rewrite the urls:

. (full stop) – match any character
* (asterix) – match zero or more of the previous symbol
+ (plus) – match one or more of the previous symbol
? (question) – match zero or one of the previous symbol
\? (backslash-something) – match special characters
^ (caret) – match the start of a string
$ (dollar) - match the end of a string
[set] – match any one of the symbols inside the square braces.
(pattern) – grouping, remember what the pattern matched as a special variable