How can we protect our htaccess file? This code has appeared there several times now: (inserted by hackers) RewriteBase / RewriteCond %{HTTP_USER_AGENT} (google|yahoo|msn|aol|bing) [OR] RewriteCond %{HTTP_REFERER} (google|yahoo|msn|aol|bing) RewriteRule . concernedly-conferrable.php [L,S=10000]  It redirects Google traffic away from our site. We changed all the passwords but after a few weeks the same problem again. Many thanks
281
This is a  about Server Security - Responding to Breach Events (Hacking)   See Also:                  Canonical Version I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism:   What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are there other initial considerations? How do I go about getting services back online? How do I prevent the same thing from happening immediately again? Are there best practices or methodologies for learning from this incident? If I wanted to put a Incident Response Plan together, where would I start? Should this be part of my Disaster Recovery or Business Continuity Planning?   Original Version       2011.01.02 - I'm on my way into work at 9.30 p.m. on a Sunday because our server has been compromised somehow and was resulting in a    attack on our provider. The servers access to the Internet   has been shut down which means over 5-600 of our clients sites are now   down. Now this could be an FTP hack, or some weakness in code   somewhere. I'm not sure till I get there.      How can I track this down quickly? We're in for a whole lot of   litigation if I don't get the server back up ASAP. Any help is   appreciated. We are running Open SUSE 11.0.            2011.01.03 - Thanks to everyone for your help. Luckily I WASN'T the only person responsible for this server, just the nearest. We managed   to resolve this problem, although it may not apply to many others in a   different situation. I'll detail what we did.      We unplugged the server from the net. It was performing (attempting to   perform) a Denial Of Service attack on another server in Indonesia,   and the guilty party was also based there.      We firstly tried to identify where on the server this was coming from,   considering we have over 500 sites on the server, we expected to be   moonlighting for some time. However, with SSH access still, we ran a   command to find all files edited or created in the time the attacks   started. Luckily, the offending file was created over the winter   holidays which meant that not many other files were created on the   server at that time.      We were then able to identify the offending file which was inside the   uploaded images folder within a  website.      After a short cigarette break we concluded that, due to the files   location, it must have been uploaded via a file upload facility that   was inadequetly secured. After some googling, we found that there was   a security vulnerability that allowed files to be uploaded, within the   ZenCart admin panel, for a picture for a record company. (The section   that it never really even used), posting this form just uploaded any   file, it did not check the extension of the file, and didn't even   check to see if the user was logged in.      This meant that any files could be uploaded, including a PHP file for   the attack. We secured the vulnerability with ZenCart on the infected   site, and removed the offending files.      The job was done, and I was home for 2 a.m.            The Moral   - Always apply security patches for ZenCart, or any other CMS system for that matter. As when security updates are released, the whole   world is made aware of the vulnerability.   - Always do backups, and backup your backups.   - Employ or arrange for someone that will be there in times like these. To prevent anyone from relying on a panicy post on Server   Fault.
12429
I have used so many things like url removal request and deleted the pages etc., but still the errors are shown in my webmaster tools.  How can I remove the urls completely from Google?
22032
User-agent: * Disallow: /robots.txt   What happens if you do this? Will search engines crawl robots.txt once and then never crawl it again?
118923
WordPress keeps writing rewrite rules into .htaccess again and again till it causes an error and causes server to return 500 Internal server error...  i.e. My .htaccess is a series of  # BEGIN WordPress &lt;IfModule mod_rewrite.c&gt; RewriteEngine On RewriteBase / RewriteRule ^index\.php$ - [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L] &lt;/IfModule&gt;  # END WordPress # BEGIN WordPress &lt;IfModule mod_rewrite.c&gt; RewriteEngine On RewriteBase / RewriteRule ^index\.php$ - [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L] &lt;/IfModule&gt;  # END WordPress   repeated over and over and over again.    By itself, that's not a massive problem (except that my .htaccess will grow to several MBs, slowing down the site significantly). But occasionally, there would appear some garbage in the .htaccess which takes the site down (500 Internal Server Error)
16031
I'm being heavily spammed by image scraper sites. There are more than 150+ domains targeting my images &amp; sending spammed links to my site. I just want to prevent hotlinking from them. I just want to block only those specific sites.  Is there any htaccess rule for preventing hotlinking in specific sites only and allow others which is not included in list?
49948
I have some pages on my site that I want to keep search engines away from, so I disallowed them in my robots.txt file like this: User-Agent: * Disallow: /email  Yet I recently noticed that Google still sometimes returns links to those pages in their search results.  Why does this happen, and how can I stop it? Background: Several years ago, I made a simple web site for a club a relative of mine was involved in.  They wanted to have e-mail links on their pages, so, to try and keep those e-mail addresses from ending up on too many spam lists, instead of using direct mailto: links I made those links point to a simple redirector /  script running on my own site.  This script would return either a 301 redirect to the actual mailto: URL, or, if it detected a suspicious access pattern, a page containing lots of random fake e-mail addresses and links to more such pages.  To keep legitimate search bots away from the trap, I set up the robots.txt rule shown above, disallowing the entire space of both legit redirector links and trap pages. Just recently, however, one of the people in the club searched Google for their own name and was quite surprised when one of the results on the first page was a link to the redirector script, with a title consisting of their e-mail address followed by my name.  Of course, they immediately e-mailed me and wanted to know how to get their address out of Google's index.  I was quite surprised too, since I had no idea that Google would index such URLs at all, seemingly in violation of my robots.txt rule. I did manage to submit a removal request to Google, and it seems to have worked, but I'd like to know why and how Google is circumventing my robots.txt like that and how to make sure that none of the disallowed pages will show up in their search results. Ps. I actually found out a possible explanation and solution, which I'll post below, while preparing this question, but  in case someone else might have the same problem.  Please do feel free to post your own answers.  I'd also be interested in knowing if other search engines do this too, and whether the same solutions work for them also.
76243
How do I create subdomain like  ? Do i have to access htaccess somehow? Is it actually simply possible to create it via pure php code or I need to use some external script-server side language?  To those who answered: Well, then, should i ask my hosting if they provide some sort of DNS access??
48917
There is a file in my public_html folder called error.log which is viewable by anyone if they just enter the URL in their browser, like: example.com/error.log  I'm running Apache. My question is, how can I hide or perhaps move this error.log so that it isn't visible to regular users?  ErrorDocument 401 default ErrorDocument 403 default ErrorDocument 404 default ErrorDocument 500 default  &lt;IfModule mod_rewrite.c&gt; RewriteEngine On  #   If you are having problems with the rewrite rules, remove the "#" from the #   line that begins "RewriteBase" below. You will also have to change the path #   of the rewrite to reflect the path to your XenForo installation. #RewriteBase /xenforo  #   This line may be needed to enable WebDAV editing with PHP as a CGI. #RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]  RewriteCond %{REQUEST_FILENAME} -f [OR] RewriteCond %{REQUEST_FILENAME} -l [OR] RewriteCond %{REQUEST_FILENAME} -d RewriteRule ^error\.log$ - [F] RewriteRule ^.*$ - [NC,L] RewriteRule ^(data/|js/|styles/|install/|favicon\.ico|crossdomain\.xml|robots\.txt) - [NC,L] RewriteRule ^.*$ index.php [NC,L]
57765
Compare these two RedirectMatch's. The first doesn't work: RedirectMatch 302 ^/redirect\.php[?]page=(.+)$ http://somewhereelse.com/$1  Versus this, which will redirect to http://somewhereelse.com/?page=wherever: RedirectMatch 302 ^/redirect\.php([?]page=.+)?$ http://somewhereelse.com/$1  Does RedirectMatch only match the URI and not the query string? Apache's documentation is a bit vague in this area. What I'm trying to do is extract the page query parameter and redirect to another site using it. Is that possible with RedirectMatch or do I have to use RewriteCond + RewriteRule?
55136
First of all, I'm not looking for miracle... I know how PHP works and that there's not really way to hide my code from the clients without using encryption. But that comes with the cost of an extension to be installed on the running server.  I'm looking for something different though... I'm not looking to encrypt my code or even obfuscate it. There are many PHP scripts without encrypted/obfuscated code but they are commercial applications. For instance, vBulletin and/or IP.Board forum applications.  I just want to know what approach do these guys use for their applications...  I'm also open to any other suggestions.  Please note that I'm a single person and not working for a company. My product is also very specific, it won't sell that much. I just want you guys to know that I can't afford to consult a legal professional either to sue someone or prepare a commercial license. I'm just looking for a simple way to protect my simple product, if it's indeed possible, somehow...
56538
I've had my website hacked. I have cleaned it and searched google site:example.com and made a list of all the results. Removed the actual links that are OK and made a list of the ones in the format of example.com/ad0-b1fermarte54eb17chb-1244425. I've submitted these links to Google to remove and Google removed these links.  The problem here is that after my initial search, that resulted in 200 URLs which we've removed, other new links appeared out of nowhere. These links don't actually work anymore and return a 404 page, but Google still has these in its results.  We've tried deleting our sitemap and re-submitting it. Google has crawled it, but again, it has not removed the dummy search results.  Looking in our google webmaster console, we saw that in the coverage tab the number of indexed links spiked from 230 (normal usage) to 10.900 links - I'm guessing these are all dummy links that were infected and now cleaned.  Any magic way of having Google remove dead links automatically? Or a way to force it to recrawl the entire website?
821
So it looks like Stack Exchange now supports HTTPS (to some extent). Which is awesome! But there are a few problems, the main one being that some content is delivered over the CDN, which is plain HTTP. This causes browsers to complain about "unsecured content":
116538
I am running a website but for some days i stopped it and put the under-construction page because the Index of admin page is visible to the outside world through the Google search. One of my friend told me that your websites index is visible and its one step away to access the password file and he shows me that very simply using the Google search.  How can i prevent this and i am hosting my site with a hosting company and i report about this to them but they simply replied to me still its secure so you no need to worry...  am i really don need to worry and continue my site with the visible index of admin page?
15575
Many times I see that URL extensions are hidden (e.g. .html, .php), but not all websites do this.  Why do webmasters hide the extension? Is it for security, for the URL to look cleaner, or for some other purpose?
487
This is a  about Apache's mod_rewrite.   Changing a request URL or redirecting users to a different URL than the one they originally requested is done using mod_rewrite. This includes such things as:   Changing HTTP to HTTPS (or the other way around) Changing a request to a page which no longer exist to a new replacement. Modifying a URL format (such as ?id=3433 to /id/3433 ) Presenting a different page based on the browser, based on the referrer, based on anything possible under the moon and sun. Anything you want to mess around with URL   Everything You Ever Wanted to Know about Mod_Rewrite Rules but Were Afraid to Ask!  How can I become an expert at writing mod_rewrite rules?   What is the fundamental format and structure of mod_rewrite rules? What form/flavor of regular expressions do I need to have a solid grasp of? What are the most common mistakes/pitfalls when writing rewrite rules? What is a good method for testing and verifying mod_rewrite rules? Are there SEO or performance implications of mod_rewrite rules I should be aware of? Are there common situations where mod_rewrite might seem like the right tool for the job but isn't? What are some common examples?   A place to test your rules  The  web site is a great place to play around with your rules and test them. It even shows the debug output so you can see what matched and what did not.
21711
After having read various articles on this site about WWW or Non-WWW website setup, ,  and , and after having setup a correct redirection rule in .Htaccess to at least eliminate duplicate contents (currently the non-www solution (e.g. http://example.com) I have a feeling that my site rank less since I changed this.   My confusion was strengthened by these two opponents:     &amp;     Could the change of www.example.com >> http://example.com have a factual impact on ranking?  say either is better or worse. Are they holding information back?  I am confused fellow folks...  As much as I would like to separate facts from fiction, I am aware that not all the good valid information is written. Not on google webmaster site and perhaps not elsewhere. If so it seems out of date!  Does or does not a WWW domain impact SEO/rank better than its NON-WWW version? (Given that you have setup a proper redirect to avoid duplicates and go with one)
54989
I am having trouble with converting .htaccess files to nginx. I have 3 .htaccess files. The first .htaccess file is located in the document root and is as follows:  Options +FollowSymLinks RewriteEngine On RewriteRule ^img-(.*)\.html img.php?id=$1 [L] RewriteRule ^slide-(.*)\.html slider.php?id=$1 [L] RewriteRule ^page-(.*)\.html page.php?name=$1 [L] RewriteRule ^contact\.html$ contact.php [QSA,L,NC]   The second .htaccess file is located in a folder called upload:  RewriteEngine On RewriteCond %{HTTP_REFERER} !^http://(.+\.)?foo\.com/ [NC] RewriteCond %{HTTP_REFERER} !^$ RewriteRule .*\.(jpe?g|gif|bmp|png)$ nohotlink.gif [L] &lt;Files ~ "\.(php|sql|php3|php4|phtml|pl|py|jsp|asp|htm|shtml|sh|cgi)$"&gt;   order allow,deny   deny from all &lt;/Files&gt;   And the third and final .htaccess file is found in a subdirectory of the upload folder named "small":  RewriteEngine Off   Now I have created a folder in /etc/nginx called includes and made 3 seperate .access files with these rewrite rules:  For the first .htaccess file located in the document root directory I have created an file in /etc/nginx/includes called root.access. In this file I have:  # nginx configuration   location /img {  rewrite ^/img-(.*)\.html /img.php?id=$1 break;  }  location /slide {      rewrite ^/slide-(.*)\.html /slider.php?id=$1 break;  }  location /page {      rewrite ^/page-(.*)\.html /page.php?name=$1 break;  }  location /contact {      rewrite ^/contact\.html$ /contact.php break;  }   For the second file located in the "upload" folder I have crated a file in /etc/nginx/includes called upload.access. This file contains the following:  # nginx configuration   location /upload {  if ($http_referer !~ "^http://(.+\.)?foo\.com/"){  rewrite .*\.(jpe?g|gif|bmp|png)$ /nohotlink.gif break;  }  }  location ~ \.(php|sql|php3|php4|phtml|pl|py|jsp|asp|htm|shtml|sh|cgi)$ {  deny all;  }   And for the third and final file I have created a file in /etc/nginx/includes names small.access. The contents of this file are as follows:  # nginx configuration   location /upload/small {  }   In the server block configuration file I have:   location / {               try_files $uri $uri/ /index.php;               include /etc/nginx/includes/root.access;      }   location /upload {               include /etc/nginx/includes/upload.access;      }   location /upload/small {               include /etc/nginx/includes/small.access;      }   Now with this configuration when trying the site I receive 403 errors. Nginx error log reports:  [error] 18156#0: *7 access forbidden by rule, client: 111.**.**.**, server: foo.com, request: "POST /upload.php HTTP/1.1", host: "foo.com", referrer: "http://foo.com/"   Now under apache everything works no problems. But I can not see why I am getting 403 errors. I am also worried that the rewrite rules as I have stated them, beyond the 403 error will not function properly at all. Can anyone help me with this? I can not see what is wrong here.