1

This is the original .htaccess on my local computer

    # Block the include-only files.
    RewriteEngine On
    RewriteBase /
    RewriteRule ^wp-admin/includes/ - [F,L]
    RewriteRule !^wp-includes/ - [S=3]
    RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
    RewriteRule ^wp-includes/theme-compat/ - [F,L]

    # BEGIN WordPress
    <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^index\.php$ - [L]

    # uploaded files
    RewriteRule ^([_0-9a-zA-Z-]+/)?files/(.+) wp-includes/ms-files.php?file=$2 [L]

    # add a trailing slash to /wp-admin
    RewriteRule ^([_0-9a-zA-Z-]+/)?wp-admin$ $1wp-admin/ [R=301,L]

    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]
    RewriteRule  ^[_0-9a-zA-Z-]+/(wp-(content|admin|includes).*) $1 [L]
    RewriteRule  ^[_0-9a-zA-Z-]+/(.*\.php)$ $1 [L]
    RewriteRule . index.php [L]
    </IfModule>

    # END WordPress

This is the new setting for online site on server. Please help me out as I know nothing about these .htaccess code. Which part do I have to take it off and which part should I keep in order to make the site running again just like on local but of course including well-protected security line of code as well?

    # Block the include-only files.
    RewriteEngine On
    RewriteBase /
    RewriteRule ^wp-admin/includes/ - [F,L]
    RewriteRule !^wp-includes/ - [S=3]
    RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
    RewriteRule ^wp-includes/theme-compat/ - [F,L]

    #disable hotlinking of images with forbidden or custom image option
    RewriteEngine on
    RewriteCond %{HTTP_REFERER} !^$
    RewriteCond %{HTTP_REFERER} !^http://(www\.)?yourdomain.com/.*$ [NC]
    #RewriteRule \.(gif|jpg)$ – [F]
    RewriteRule \.(gif|jpg)$ http://www.yourdomain.com/stealingisbad.gif [R,L]

    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} POST
    RewriteCond %{REQUEST_URI} .wp-comments-post\.php*
    RewriteCond %{HTTP_REFERER} !.*yourblog.com.* [OR]
    RewriteCond %{HTTP_USER_AGENT} ^$
    RewriteRule (.*) ^http://%{REMOTE_ADDR}/$ [R=301,L]

    # protect wpconfig.php
    <Files wp-config.php>
    order allow,deny
    deny from all
    </Files>

    # disable directory browsing
    Options All -Indexes

    <Files ~ “^.*\.([Hh][Tt][Aa])”>
    order allow,deny
    deny from all
    satisfy all
    </Files>

    Order deny,allow
    Deny from all
    <Files ~ ".(xml|css|jpe?g|png|gif|js)$">
    Allow from all
    </Files>

    # Protect the .htaccess
    <files .htaccess="">
    order allow,deny
    deny from all
    </files>

    # BEGIN WordPress
    <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^index\.php$ - [L]

    # uploaded files
    RewriteRule ^([_0-9a-zA-Z-]+/)?files/(.+) wp-includes/ms-files.php?file=$2 [L]

    # add a trailing slash to /wp-admin
    RewriteRule ^([_0-9a-zA-Z-]+/)?wp-admin$ $1wp-admin/ [R=301,L]

    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]
    RewriteRule  ^[_0-9a-zA-Z-]+/(wp-(content|admin|includes).*) $1 [L]
    RewriteRule  ^[_0-9a-zA-Z-]+/(.*\.php)$ $1 [L]
    RewriteRule . index.php [L]
    </IfModule>

    # END WordPress
Improve this question

3 Answers 3

Reset to default
1

amtik is correct in looking at the code that needs to be addressed.

Order deny,allow
Deny from all
<Files ~ ".(xml|css|jpe?g|png|gif|js)$">
Allow from all
</Files>

That code was originally only designed to be used in wp-includes and wp-content not in the root of your WordPress install, but even then it will still break themes and plugins. Plus it would be better written like so:

Order Allow,Deny
<FilesMatch "\.(xml|css|jpe?g|png|gif|js)$">
Allow from all
</FilesMatch>

But it would need to go in an .htaccess file in your wp-includes and wp-content directories. I would suggest you just remove it completely and see if your site works. Then create new .htaccess files with the above content for your wp-includes and wp-content directories and see if anything breaks. There's a good likelihood that something will break it just depends if the user's browser needs something from those directories.

Improve this answer
2
  • The default settings are allow from all, that does even if not we have not included this code in .htaccess files. #UPDATE - I did a code that allow particular domain to access those files.
    – Amit Kosti
    Jul 9, 2012 at 17:08
  • Sort of. The Allow, Deny Directive works like this. Anything that does not match an "Allow from all" statement is denied. Which is basically whitelisting. If you use the Deny,Allow Directive - anything that doesn't match a "Deny from all" it is allowed, which is basically blacklisting.
    – MickeyRoush
    Jul 9, 2012 at 22:54
0

just saw that this post is from 3 years ago, so, maybe it'll be useful to somebody:(

First i assume that u dont activate Multisite or did WordPress MU because if so u dont need:

 <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^index\.php$ - [L]

    # uploaded files
    RewriteRule ^([_0-9a-zA-Z-]+/)?files/(.+) wp-includes/ms-files.php?file=$2 [L]

    # add a trailing slash to /wp-admin
    RewriteRule ^([_0-9a-zA-Z-]+/)?wp-admin$ $1wp-admin/ [R=301,L]

    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^ - [L]
    RewriteRule  ^[_0-9a-zA-Z-]+/(wp-(content|admin|includes).*) $1 [L]
    RewriteRule  ^[_0-9a-zA-Z-]+/(.*\.php)$ $1 [L]
    RewriteRule . index.php [L]
    </IfModule>

u have a problems with ur code :

  1. Rewrite rules like RewriteEngine need to be inside tags

    <IfModule mod_rewrite.c>
ur rules
</IfModule>

  2. u have this code wrong

    Order deny,allow
Deny from all
<Files ~ ".(xml|css|jpe?g|png|gif|js)$">
Allow from all
</Files>

delete 

 Order deny,allow
 Deny from all

add below Allow from all

Satisfy Any

  1. u dont need to limit htaccess it's already the default so remove those lines (also .htaccess dont need ="" ):

    # Protect the .htaccess
<files .htaccess="">
order allow,deny
deny from all
</files>

    and 

    <Files ~ “^.*\.([Hh][Tt][Aa])”>
order allow,deny
deny from all
satisfy all
</Files>

    also if u still want the above to work u need to use it like this:

    <Files ~ “^.*\.([Hh][Tt][Aa])”>
Order Allow,Deny        
satisfy all
</Files>

  2. instead of blocking the includes 

    # Block the include-only files.
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]

block the entire wp-admin folder create htaccess file in the wp-admin folder with this code:

order allow,deny
deny from all
allow from <your ip>

now u said "Cannot login to Wordpress site after changing .htaccess for security purposes"

    order allow,deny
    deny from all

that because those lines are missed placed (in 2 above)

Improve this answer
-1

UPDATED :- ( Code Updated )

Replace this 

Order deny,allow
Deny from all
<Files ~ ".(xml|css|jpe?g|png|gif|js)$">
Allow from all
</Files>

with 

<Files ~ ".(xml|css|jpe?g|png|gif|js)$">
Order deny,allow
Deny from all
Allow from yourblog.com
</Files>

See the yourblog.com - used to allow only your domain to access those files

The above code don't do anything. By default everyone can access those files, if you deny it, No one will have access to those files even your own domain. If you are looking for a code to block hotlinking to images as well as JS / CSS files then use the code given at end.

To block CSS, JS and Image files from hot-linking use follwing code

If you are looking to block hotlinking to your images as well as the css/js files then use following code.

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain.com/.*$ [NC]
RewriteRule \.(gif|jpg|js|css)$ - [F]

NOTICE - You are using this code already to block hot-linking to only image files-jpg/gif. Replcae that with given code so that it also works with JS and CSS.

Improve this answer
4
  • My local wordpress installation run perfectly with this customization....
    – Amit Kosti
    Jul 9, 2012 at 6:00
  • No disrespect, but the code you're suggesting, does nothing. In fact it actually nullifies itself. httpd.apache.org/docs/2.2/mod/mod_authz_host.html#order
    – MickeyRoush
    Jul 9, 2012 at 12:30
  • In fact the Deny,Allow Order Directive was meant to be like a blacklist, but since there are so only a few files that need to be accessed, it would be better to whitelist instead using the Allow,Deny Order Directive in my answer. But it should only be used in directories where only those files need to be accessed by the user's browser.
    – MickeyRoush
    Jul 9, 2012 at 12:36
  • I did updated my anser with new code, that'd allow only that domain to access files. just like IP address.
    – Amit Kosti
    Jul 9, 2012 at 20:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.