Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

This is the original .htaccess on my local computer

    # Block the include-only files.
    RewriteEngine On
    RewriteBase /
    RewriteRule ^wp-admin/includes/ - [F,L]
    RewriteRule !^wp-includes/ - [S=3]
    RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
    RewriteRule ^wp-includes/theme-compat/ - [F,L]

    # BEGIN WordPress
    <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^index\.php$ - [L]

    # uploaded files
    RewriteRule ^([_0-9a-zA-Z-]+/)?files/(.+) wp-includes/ms-files.php?file=$2 [L]

    # add a trailing slash to /wp-admin
    RewriteRule ^([_0-9a-zA-Z-]+/)?wp-admin$ $1wp-admin/ [R=301,L]

    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]
    RewriteRule  ^[_0-9a-zA-Z-]+/(wp-(content|admin|includes).*) $1 [L]
    RewriteRule  ^[_0-9a-zA-Z-]+/(.*\.php)$ $1 [L]
    RewriteRule . index.php [L]
    </IfModule>

    # END WordPress

This is the new setting for online site on server. Please help me out as I know nothing about these .htaccess code. Which part do I have to take it off and which part should I keep in order to make the site running again just like on local but of course including well-protected security line of code as well?

    # Block the include-only files.
    RewriteEngine On
    RewriteBase /
    RewriteRule ^wp-admin/includes/ - [F,L]
    RewriteRule !^wp-includes/ - [S=3]
    RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
    RewriteRule ^wp-includes/theme-compat/ - [F,L]

    #disable hotlinking of images with forbidden or custom image option
    RewriteEngine on
    RewriteCond %{HTTP_REFERER} !^$
    RewriteCond %{HTTP_REFERER} !^http://(www\.)?yourdomain.com/.*$ [NC]
    #RewriteRule \.(gif|jpg)$ – [F]
    RewriteRule \.(gif|jpg)$ http://www.yourdomain.com/stealingisbad.gif [R,L]

    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} POST
    RewriteCond %{REQUEST_URI} .wp-comments-post\.php*
    RewriteCond %{HTTP_REFERER} !.*yourblog.com.* [OR]
    RewriteCond %{HTTP_USER_AGENT} ^$
    RewriteRule (.*) ^http://%{REMOTE_ADDR}/$ [R=301,L]

    # protect wpconfig.php
    <Files wp-config.php>
    order allow,deny
    deny from all
    </Files>

    # disable directory browsing
    Options All -Indexes

    <Files ~ “^.*\.([Hh][Tt][Aa])”>
    order allow,deny
    deny from all
    satisfy all
    </Files>

    Order deny,allow
    Deny from all
    <Files ~ ".(xml|css|jpe?g|png|gif|js)$">
    Allow from all
    </Files>

    # Protect the .htaccess
    <files .htaccess="">
    order allow,deny
    deny from all
    </files>

    # BEGIN WordPress
    <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^index\.php$ - [L]

    # uploaded files
    RewriteRule ^([_0-9a-zA-Z-]+/)?files/(.+) wp-includes/ms-files.php?file=$2 [L]

    # add a trailing slash to /wp-admin
    RewriteRule ^([_0-9a-zA-Z-]+/)?wp-admin$ $1wp-admin/ [R=301,L]

    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]
    RewriteRule  ^[_0-9a-zA-Z-]+/(wp-(content|admin|includes).*) $1 [L]
    RewriteRule  ^[_0-9a-zA-Z-]+/(.*\.php)$ $1 [L]
    RewriteRule . index.php [L]
    </IfModule>

    # END WordPress
share|improve this question
add comment

2 Answers 2

amtik is correct in looking at the code that needs to be addressed.

Order deny,allow
Deny from all
<Files ~ ".(xml|css|jpe?g|png|gif|js)$">
Allow from all
</Files>

That code was originally only designed to be used in wp-includes and wp-content not in the root of your WordPress install, but even then it will still break themes and plugins. Plus it would be better written like so:

Order Allow,Deny
<FilesMatch "\.(xml|css|jpe?g|png|gif|js)$">
Allow from all
</FilesMatch>

But it would need to go in an .htaccess file in your wp-includes and wp-content directories. I would suggest you just remove it completely and see if your site works. Then create new .htaccess files with the above content for your wp-includes and wp-content directories and see if anything breaks. There's a good likelihood that something will break it just depends if the user's browser needs something from those directories.

share|improve this answer
    
The default settings are allow from all, that does even if not we have not included this code in .htaccess files. #UPDATE - I did a code that allow particular domain to access those files. –  amit Jul 9 '12 at 17:08
    
Sort of. The Allow, Deny Directive works like this. Anything that does not match an "Allow from all" statement is denied. Which is basically whitelisting. If you use the Deny,Allow Directive - anything that doesn't match a "Deny from all" it is allowed, which is basically blacklisting. –  MickeyRoush Jul 9 '12 at 22:54
add comment

UPDATED :- ( Code Updated )

Replace this

Order deny,allow
Deny from all
<Files ~ ".(xml|css|jpe?g|png|gif|js)$">
Allow from all
</Files>

with

<Files ~ ".(xml|css|jpe?g|png|gif|js)$">
Order deny,allow
Deny from all
Allow from yourblog.com
</Files>

See the yourblog.com - used to allow only your domain to access those files

The above code don't do anything. By default everyone can access those files, if you deny it, No one will have access to those files even your own domain. If you are looking for a code to block hotlinking to images as well as JS / CSS files then use the code given at end.

To block CSS, JS and Image files from hot-linking use follwing code

If you are looking to block hotlinking to your images as well as the css/js files then use following code.

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain.com/.*$ [NC]
RewriteRule \.(gif|jpg|js|css)$ - [F]

NOTICE - You are using this code already to block hot-linking to only image files-jpg/gif. Replcae that with given code so that it also works with JS and CSS.

share|improve this answer
    
My local wordpress installation run perfectly with this customization.... –  amit Jul 9 '12 at 6:00
    
No disrespect, but the code you're suggesting, does nothing. In fact it actually nullifies itself. httpd.apache.org/docs/2.2/mod/mod_authz_host.html#order –  MickeyRoush Jul 9 '12 at 12:30
    
In fact the Deny,Allow Order Directive was meant to be like a blacklist, but since there are so only a few files that need to be accessed, it would be better to whitelist instead using the Allow,Deny Order Directive in my answer. But it should only be used in directories where only those files need to be accessed by the user's browser. –  MickeyRoush Jul 9 '12 at 12:36
    
I did updated my anser with new code, that'd allow only that domain to access files. just like IP address. –  amit Jul 9 '12 at 20:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.