Skip to main content

htaccess

Block wp-includes folder and files Wordpress

To hide sensitive files in the wp-includes folder, add the following code to the .htaccess file in the root of your site:

 

# Block wp-includes folder and files
 <IfModule mod_rewrite.c>
 RewriteEngine On
 RewriteBase /
 RewriteRule ^wp-admin/includes/ - [F,L]
 RewriteRule !^wp-includes/ - [S=3]
 RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
 RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
 RewriteRule ^wp-includes/theme-compat/ - [F,L]
 </IfModule>

Prevent execute PHP file in wp-content/uploads directory

wp-content/uploads directory

your wpcontent/uploads directory should be considered a potential entry point and can be exploited for number of wordpress hacks . The biggest potential threat is the uploading of PHP files.

If you can browse /wpcontent/plugins/ – the enumeration of plugins and versions becomes much easier! Exploiting this can allow an attacker to obtain sensitive information that could aid in further attacks.

Block Some Bots using htaccess

A lot of time we get many requests from some bots we do not need here you can block them from htaccess file 

 

<IfModule mod_setenvif.c>
  SetEnvIfNoCase User-Agent (SemrushBot|Semrush|python-requests|sqlmap|wordpress|apachebench) bad_user_agents

  Order Allow,Deny
  Allow from all
  Deny from env=bad_user_agents
</IfModule>

Wordpress htaccess configuration

as you know that WordPress is one of the most famous CMS in the world but unforunatily it is not secure enough and we have to protect it somehow abd also we need to setup some cache configuration in the htaccess

First thing you need to do is to disable directory listing by adding this line to .htaccess

Options All -Indexes

 

the other thing you need to do is to setup the objects cache (image/css files/ js files)

this is one of the best code we can use 

 

 

Magento 2 static files are not working

How many times you tried to install Magento 2 and later you could not see the website working !!, How many times you tried to search for these sentences 

"Magento 2 css not working"

"Magento 2 js not working"

"Magento 2 404 page not found" because of the static files?

Now here is the solution, and easily it is the missed .htaccess (for apache)

by quick look at this path "{magento root}/pub/static", you will see that you missed the .htaccess file