Complete .htaccess example for a CMS

The following is a collection of things I have learned about .htaccess the hard way. I will give an example of a complete .htaccess file for a CMS:

-----------------------------------

AddType x-mapp-php5 .php
Options +FollowSymLinks
Options -Indexes
ServerSignature Off

redirect 301 /software/firefox/firefox_download_manager_2_files_limit_fix.html http://mkrd.info/?page=2-files-limit-fix
#redirect 301

RewriteRule ^linux/switching-to-linux.html$ http://wiki.mkrd.info/Switching_to_Linux [R=301,L]
#RewriteRule ^oldurl$ newurl [R=301,L]

#RewriteRule ^mediawiki/index.php?title=Main_Page$ http://wiki.mkrd.info/Main_Page [R=301,L]
#^does not work

redirect gone /services-available/repair-website-or-server-infection/be-careful-about-others-fixes.html
#redirect gone

ErrorDocument 410 /410-error----page-gone.html

# Deny access to config.php
# This can be useful if php ever breaks or dies
# Use with caution, this may break other functions of CMSMS that use a config.php
# file.  This may also break other programs you have running under your CMSMS
# install that use config.php.  You may need to add another .htaccess file to those
# directories to specifically allow config.php.
<Files "config.php">
order allow,deny
deny from all
</Files>

<IfModule mod_rewrite.c>
RewriteEngine on
#
#Sub-dir e.g: /cmsms/
RewriteBase /

# URL Filtering helps stop some hack attempts
#IF the URI contains a "http:"
RewriteCond %{QUERY_STRING} http\: [OR]
#OR if the URI contains a "["
RewriteCond %{QUERY_STRING} \[ [OR]
#OR if the URI contains a "]"
RewriteCond %{QUERY_STRING} \] [OR]
#OR if the URI contains a "<script>"
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
#OR script trying to set a PHP GLOBALS variable via URL
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
#OR any script trying to modify a _REQUEST variable via URL
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^.*$ - [F,L]
# END Filtering

# 301 Redirect all requests that don't contain a dot or trailing slash to
# include a trailing slash
# but ignore POST requests.
#RewriteCond %{REQUEST_URI} !/$
#RewriteCond %{REQUEST_URI} !\.
#RewriteCond %{REQUEST_METHOD} !POST$
#RewriteRule ^(.*) %{REQUEST_URI}/ [R=301,L]

# Rewrites URLs in the form of /parent/child/
# but only rewrites if the requested URL is not a file or directory
#
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.+)$ index.php?page=$1 [QSA]
</IfModule>

<IfModule mod_header.c>
# Disable ETags
Header unset ETag
FileEtag None
</IfModule>

<IfModule mod_deflate.c>
# Compress css, plaintext, xml, gif, and images in transport.
AddOutputFilterByType DEFLATE text/css text/plain text/xml image/gif image/jpeg image/png
</IfModule>

<IfModule mod_expires.c>
<FilesMatch "\.(ico|pdf|flv|jpg|jpeg|png|gif|js|css|swf)$">
# Set expires tags on various files... so that the browser wont attempt to reload them.
ExpiresActive On
ExpiresDefault "access plus 1 year"
<IfModule mod_header.c>
  # Setting cache control to public allows proxy servers to cache the items too.
  Header set Cache-Control "public"
</IfModule>
</FilesMatch>
</IfModule>

-----------------------------------

This may be a little too much to handle, so let's take it on in sections.

AddType x-mapp-php5 .php

For 1and1, this specifies PHP5

 

Options +FollowSymLinks
Options -Indexes
ServerSignature Off

Is for rudimentary security

 

redirect 301 /software/firefox/firefox_download_manager_2_files_limit_fix.html http://mkrd.info/?page=2-files-limit-fix

Is a correct implementation of a 301 permanent redirect to another page on the same website

 

#redirect 301

Was left to be used to add entries later. "#" Here comments out a line.

 

RewriteRule ^linux/switching-to-linux.html$ http://wiki.mkrd.info/Switching_to_Linux [R=301,L]

A different method is used to redirect to another domain (a subdomain here).

 

#RewriteRule ^mediawiki/index.php?title=Main_Page$ http://wiki.mkrd.info/Main_Page [R=301,L]
#^does not work

Leaving notes to myself here. htaccess does not work with PHP script type URLs! This is a pretty good reason to use Pretty URLs. No matter what the other incompetent types say, ?page= style of "short" URLs is nothing good.

 

redirect gone /services-available/repair-website-or-server-infection/be-careful-about-others-fixes.html

Being a considerate web developer, I let crawlers know that a page was deleted.

 

ErrorDocument 410 /410-error----page-gone.html

Here I am specifying a human--friendly error page for the redirect above.

 

# Deny access to config.php# URL Filtering helps stop some hack attempts# Disable ETags

Are all rudimentary security precautions

 

#Sub-dir e.g: /cmsms/# 301 Redirect all requests that don't contain a dot or trailing slash to include a trailing slash but ignore POST requests.# Rewrites URLs in the form of /parent/child/

This is where Pretty URLs happen

 

# Compress css, plaintext, xml, gif, and images in transport.

Making sure that my pages get served quickly!



˅˅˅ Additional valuable information is available at one of the links below: ˅˅˅

 

Did you like the article? Let Google Search know by clicking this button: . Please link to content that you find useful on this website on your own website, forum or blog! You can also comment on this page below, or contact me to ask a question or suggest a topic for me to research. There is a user-editable Wiki available on my website, as well as a Forum that you can contribute to. Site Map.

Page last modified 06-Jan-13 21:33:20 EST
Comments on this page:


Add a comment to this page
Comment Title:
Your Name:
Your Email Address:
Notify me of new comments to this item:
Additional Comments:
This is a captcha-picture. It is used to prevent mass-access by robots. (see: www.captcha.net)