Htaccess examples
| tbd @ |
|---|
Background
.htaccess is a configuration file which contains rules for the folder it is in, and all the folders beneath it. On this page we show some of the code we use at Wiki Aventurica.
Code Examples
<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE application/javascript
AddOutputFilterByType DEFLATE application/rss+xml
AddOutputFilterByType DEFLATE application/vnd.ms-fontobject
AddOutputFilterByType DEFLATE application/x-font
AddOutputFilterByType DEFLATE application/x-font-opentype
AddOutputFilterByType DEFLATE application/x-font-otf
AddOutputFilterByType DEFLATE application/x-font-truetype
AddOutputFilterByType DEFLATE application/x-font-ttf
AddOutputFilterByType DEFLATE application/x-javascript
AddOutputFilterByType DEFLATE application/xhtml+xml
AddOutputFilterByType DEFLATE application/xml
AddOutputFilterByType DEFLATE font/opentype
AddOutputFilterByType DEFLATE font/otf
AddOutputFilterByType DEFLATE font/ttf
AddOutputFilterByType DEFLATE image/svg+xml
AddOutputFilterByType DEFLATE image/x-icon
AddOutputFilterByType DEFLATE text/css
AddOutputFilterByType DEFLATE text/html
AddOutputFilterByType DEFLATE text/javascript
AddOutputFilterByType DEFLATE text/plain
AddOutputFilterByType DEFLATE text/xml
BrowserMatch ^Mozilla/4 gzip-only-text/html
BrowserMatch ^Mozilla/4\.0[678] no-gzip
BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
Header append Vary User-Agent
</IfModule>
mod_expires
<IfModule mod_expires.c>
ExpiresActive On
# Default expiration
ExpiresDefault "access plus 1 week"
# Data interchange
ExpiresByType application/json "access plus 0 seconds"
ExpiresByType application/xml "access plus 0 seconds"
ExpiresByType application/rss+xml "access plus 1 hour"
ExpiresByType application/atom+xml "access plus 1 hour"
# Favicon (can be cached for a long time)
ExpiresByType image/x-icon "access plus 1 year"
# Media: images, video, audio
ExpiresByType image/gif "access plus 1 month"
ExpiresByType image/png "access plus 1 month"
ExpiresByType image/jpg "access plus 1 month"
ExpiresByType image/jpeg "access plus 1 month"
ExpiresByType image/webp "access plus 1 month"
ExpiresByType video/ogg "access plus 1 month"
ExpiresByType audio/ogg "access plus 1 month"
ExpiresByType video/mp4 "access plus 1 month"
ExpiresByType video/webm "access plus 1 month"
# CSS and JavaScript
ExpiresByType text/css "access plus 1 year"
#ExpiresByType application/javascript "access plus 1 year"
#ExpiresByType application/x-javascript "access plus 1 year"
#ExpiresByType text/javascript "access plus 1 year"
# 1 year is too long
# Webfonts
ExpiresByType font/otf "access plus 1 month"
ExpiresByType font/ttf "access plus 1 month"
ExpiresByType font/woff "access plus 1 month"
ExpiresByType font/woff2 "access plus 1 month"
ExpiresByType application/font-woff "access plus 1 month"
ExpiresByType application/font-woff2 "access plus 1 month"
ExpiresByType image/svg+xml "access plus 1 month"
# Other
ExpiresByType application/pdf "access plus 1 month"
ExpiresByType image/vnd.microsoft.icon "access plus 1 year"
</IfModule>
mod_headers
<IfModule mod_headers.c>
Header set X-Frame-Options "SAMEORIGIN"
Header set X-Content-Type-Options "nosniff"
</IfModule>
RewriteEngine On
RewriteBase /
Options +SymLinksIfOwnerMatch
# user agent should exist; if not: directly to bot-trap
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule ^.*$ https://yourwebsite.example/bot-trap/index.php [R=301,QSD,END]
# known malware-bots: directly to bot-trap
RewriteCond %{HTTP_USER_AGENT} (libredtail) [NC]
RewriteRule ^.*$ https://yourwebsite.example/bot-trap/index.php [R=301,QSD,END]
# Internet archive does not respect robots.txt anymore: directly to bot-trap
RewriteCond %{HTTP_USER_AGENT} (wikiteam3|archivebot|archiveteam|wikikeeper|wikiarchive|saveweb|heritrix|zeno|archive.org|archive.org_bot|ia_archiver) [NC]
RewriteRule ^.*$ https://yourwebsite.example/bot-trap/index.php [R=301,QSD,END]
# requesting php-pages not used by our website: directly to bot-trap
RewriteCond %{REQUEST_URI} /(wp-login|signup|login|viewtopic|memberlist|register|admin|password_forgotten|sqlpatch|join|wikka|ofc_upload_image|curltest|auth|getir|sql|wp_filemanager|xmlrpc|mac|ano|zoo2|one|btyuio|fling|samll|chosen|ops|bulet)\.php$ [NC]
RewriteRule ^.*$ https://yourwebsite.example/bot-trap/index.php [R=301,QSD,END]
# requesting files we do not have: directly to bot-trap
RewriteCond %{REQUEST_URI} /(wwwroot|web|reg|guestadd|bokeindex|CreateUser|conn_index|footer_index|w_hiden_index|no_password)\.(zip|rar|asp|lua)$ [NC]
RewriteRule ^.*$ https://yourwebsite.example/bot-trap/index.php [R=301,QSD,END]
# searching for admin access: directly to bot-trap
RewriteCond %{REQUEST_URI} /(administrator|wp-admin|wp-json|components|sqliteManager)/$ [NC]
RewriteRule ^.*$ https://yourwebsite.example/bot-trap/index.php [R=301,QSD,END]
# searching for system folders: directly to bot-trap
RewriteCond %{REQUEST_URI} /\.(azure|aws|claude|bashrc|vscode)/ [NC]
RewriteRule ^.*$ https://yourwebsite.example/bot-trap/index.php [R=301,QSD,END]
# attempted code injection: directly to bot-trap
RewriteCond %{REQUEST_URI} java.lang.runtime [NC]
RewriteRule ^.*$ https://yourwebsite.example/bot-trap/index.php [R=301,QSD,END]
# lying about referrer: directly to bot-trap
RewriteCond %{HTTP_USER_AGENT} !(bot|crawler) [NC]
RewriteCond %{HTTP_REFERER} \.yourwebsite\.example [NC]
RewriteCond %{HTTP_REFERER} !(mysite|oursite)\.yourwebsite\.example [NC]
RewriteRule ^.*$ https://yourwebsite.example/bot-trap/index.php [R=301,QSD,END]
# exclude your existing subdomains in the second-to-last line
# SSL everywhere
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
# no www
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ https://%1%{REQUEST_URI} [R=301,L]
# redirect plain domain request to main page
RewriteCond %{HTTP_HOST} ^yourwebsite\.example$ [NC]
RewriteRule ^/*$ https://yourwebsite.example/wiki/Main_page [R=301,L]
# https://www.mediawiki.org/wiki/Manual:Short_URL/Apache
RewriteCond %{HTTP_HOST} ^yourwebsite\.example$ [NC]
RewriteRule ^/?wiki(/.*)?$ %{DOCUMENT_ROOT}/w/index.php [QSA,L]
ErrorDocument 404 /waerror/404.php ErrorDocument 503 /waerror/503.php
IP banning
IP addresses can and should be banned using the Plesk Firewall, but Bot-trap writes to .htaccess, so there will be some amount of banned IPs there too.
This code uses the Apache 2.4 syntax.
<RequireAll>
Require all granted
Require not ip 91.212.106.65
</RequireAll>