.htaccess tutorial

htaccess Elite


Htaccess to Secure a Public Directory

Security in htaccess: htpasswd, 401 Authentication

Htaccess to Secure a Public Directory

Postby produke » 02 Oct 2006 01:41

You need to remove their ability to execute scripts.

Heres a couple different ways I do it
Code: Select all
AddHandler cgi-script .php .pl .py .jsp .asp .htm .shtml .sh .cgi
Options -ExecCGI


This is cool, you are basically categorizing all those scripts extensions so that they fall under the jurisdiction of the -ExecCGI command, which also means -FollowSymLinks



Combine that with

Code: Select all
<Files .htaccess>
order allow,deny
deny from all
</Files>



Then you might try
Code: Select all
   

Options -ExecCGI -Indexes -All


RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS|HEAD)
RewriteRule .* - [F]

RewriteEngine Off



If you'd rather have .pl, .py, or .cgi files displayed in the browser rather than executed as scripts, simply create a .htaccess file in the relevant directory with the following content:
Code: Select all
RemoveHandler cgi-script .pl .py .cgi
User avatar
produke
 
Posts: 242
Joined: 25 Sep 2006 04:48

Return to Security and Authentication



cron