CMS Security Handbook: The Comprehensive Guide for WordPress®, Joomla!®, Drupal™, and Plone®

.htaccess settings

The.htaccess file is a configuration file that can be placed on a per-directory level when you're running Apache Web Server software. Within this file, you can tweak and set very specific Apache directives.

This section describes a few of the more popular .htaccess settings. Many of these examples are courtesy of Perishablepress.com. For more information, see the following resources:

• http://www.htaccess-guide.com
• http://httpd.apache.org/docs/2.2/mod/quickreference.html

WordPress users should visit http://perishablepress.com/press/tag/security/ to see various .htaccess samples. Joomla! users should visit http://snipt.net/nikosdion/the-master-htaccess/ to learn about specifics for using .htaccess to better secure Joomla! sites.

Blocking IP Addresses

Following is an example of blocking IP addresses from visiting your site:

<Limit GET POST PUT>
 Order Allow,Deny
 Allow from all
 Deny from xxx.xxx.xxx.xxx
 Deny from xxx.xxx.xxx.xxx
 Deny from xxx.xxx.xxx.xxx
 Deny from xxx.xxx.xxx.xxx
</Limit>

Blocking Bad Bots

A class of malware that attacks websites is bad bots. These malicious creatures either break in or gather information used to break in. Blocking them is a regular and frequent task. Fortunately, .htaccess provides a simple method to do it.

For a good example to use to block bad bots in .htaccess, see http://perishablepress.com/press/2010/08/09/2010-user-agent-blacklist and copy down the directives from 2010 User-Agent Blacklist.

Protecting a Specific File

The ...