Web Burble   How_To_Build_A_Website


How To Create A WordPress Website

speed up outlook

go tour thailand

website access

This section describes how to control access by visitors to your website and assumes your website is using the most common type of web server which is Apache, running on a Linux type system and the hosting plan includes cPanel.

Otherwise you may possibly be using a Microsoft IIS website which works completely differently or a very cheap hosting plan (website builder) that does not have access to control the web server, or your "shared" web server.

The  .htaccess  file is in the root directory (folder) of your website. This file controls how your website is accessed by visitors. Your cPanel will also have security functions for controlling access whereby you do not need to manually add script to the  .htaccess  file. Because this file is telling the web server what to do,  it is important to have a backup copy and be aware any misconfiguration can "break" your website.


Making it all Visitor Friendly

Search Engine Friendly (SEF) websites allow a Search Bot to crawl your website content and create an index of content for words, phrases and images. Some well known search bots are GoogleBot and BingBot. When humans use Google or Bing to search the Internet, hopefully your website will be in the list. So, creating SEF content is one important component in website design. Many content management systems such as Joomla! make this very easy to configure because it will insert the required code into your  .htaccess  file automatically with very little configuration, you just need to turn SEF on.


Increasing Security by Hardening your Website

Making it difficult or nearly impossible for your website to be "hacked" can be helped by adding some code to your .htaccess  file.

Joomla! and other content management systems can automatically add rules to help block some common exploits. Code is added when the CMS is initially installed.

RewriteEngine On

## Begin - Rewrite rules to block out some common exploits.
# If you experience problems on your site block out the operations listed below
# This attempts to block the most common type of exploit `attempts` to Joomla!
# Block out any script trying to base64_encode data within the URL.
RewriteCond %{QUERY_STRING} base64_encode[^(]*\([^)]*\) [OR]
# Block out any script that includes a <script> tag in URL.
RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
# Block out any script trying to set a PHP GLOBALS variable via URL.
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
# Block out any script trying to modify a _REQUEST variable via URL.
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
# Return 403 Forbidden header and show the content of the root homepage
RewriteRule .* index.php [F]
## End - Rewrite rules to block out some common exploits.


 Some other precautions can be added. Normally the system files would not be accessible.

#Prevent viewing of  .htaccess  file
<Files .htaccess>
 order allow,deny
 deny from all

#Deny access to configuration file <FilesMatch "configuration.php"> Order allow,deny Deny from all </FilesMatch> #Deny hacker to put or delete files to web server <Limit PUT DELETE> Order allow,deny Deny from all </Limit>


This code helps prevent unintentional access to important files that may have been accidentally left on the website and not moved or deleted. These files may have been left by some text or html editors and can pose a huge security issue if someone accesses the file.

#Block access to backup and source files
<FilesMatch "(\.(bak|config|sql|fla|psd|ini|log|sh|inc|swp|dist)|~)$">
  Order allow,deny
  Deny from all
  Satisfy All


Restricting Access from Unwanted Visitors

 Creating a "deny" list of servers from around the world can help block hackers and spammers. They will receive a page not found error or denied error when attempting to access your website.

These lists should be updated regularly as more are added and some may have been removed. An excellent website to get these lists is  http://www.wizcrafts.net/htaccess-blocklists.html

Below is a partial sample only.

<Files *>
order deny,allow
# Russia (RU), Ukraine (UA), Belarus (BY), Bulgaria (BG), Czech Republic (CZ), Romania (RO),
# Latvia (LV), Estonia (EE), Kazakstan (KZ), Moldavia/Moldova (MD), Poland (PL), Serbia (RS),
# Siberia, Slovakia (SK), Slovenia (SL) deny from
# Hungary (HU) deny from # Poland (PL) deny from # Turkey (TR): web hosts and Turk Telekom customers - scammers, spammers, phishing websites and server script exploiters: deny from # France deny from # German (DE) ISPs used by hackers and spammers including 1&1internet DE, Deutsche Telekom AG, NetDirekt and Schlund & Partners deny from # Iran (IR) deny from



© 2019 Adrian Butterly WebBurble.Com. All Rights Reserved.