Code:
RewriteEngine On
# proc/self/environ? no way!
RewriteCond %{QUERY_STRING} proc/self/environ [OR]
# Block out any script trying to set a mosConfig value through the URL
RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]
# Block out any script trying to base64_encode crap to send via URL
RewriteCond %{QUERY_STRING} base64_encode.*(.*) [OR]
# Block out any script that includes a <script> tag in URL
RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR]
# Block out any script trying to set a PHP GLOBALS variable via URL
RewriteCond %{QUERY_STRING} GLOBALS(=|[|\%[0-9A-Z]{0,2}) [OR]
# Block out any script trying to modify a _REQUEST variable via URL
RewriteCond %{QUERY_STRING} _REQUEST(=|[|\%[0-9A-Z]{0,2})
# Send all blocked request to homepage with 403 Forbidden error!
RewriteRule ^(.*)$ index.php [F,L]
All you need to Fail the request is RewriteRule .? - [F]
It seems okay so far.
Options +FollowSymLinks
Why would you add this now?
RewriteEngine On
DITTO!
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
I thought you'd decided above to FAIL the request
RewriteRule ^(.*)$ index.php [F,L]
#Options +FollowSymlinks
RewriteEngine On
Repeat DITTO!
RewriteCond %{http_host} ^yoursite.com
You don't bother to specify (escape) dot characters, use end anchors or specify No Case?
RewriteRule ^(.*) http://www.yoursite.com/$1 [R=301,L]
I would have used RewriteRule .? http://www.yoursite.com%{REQUEST_URI} [R=301,L]
# Protect from spam bots
<IfModule mod_rewrite.c>
[rant #4]
The definition of an idiot is someone who repeatedly does the same thing expecting a different result. Asking Apache to confirm the existence of ANY module with an <IfModule> ... </IfModule> wrapper is the same thing in the webmaster world. DON'T BE AN IDIOT! If you don't know whether a module is enabled, run the test ONCE then REMOVE the wrapper as it is EXTREMELY wasteful of Apache's resources (and should NEVER be allowed on a shared server).
[/rant 4]
Repetitively repeat DITTO!
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} .wp-comments-post\.php*
Zero or more p's on the .ph?
RewriteCond %{HTTP_REFERER} !.yoursite.com.* [OR]
Same as above on %{HTTP_HOST}
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule (.*) ^http://%{REMOTE_ADDR}/$ [R=301,L]
... how many ISPs/hackers would use their own IP address? (Hint: Zero)
</IfModule>
# STRONG HTACCESS PROTECTION</code>
<Files ~ "^.*\.([Hh][Tt][Aa])">
Seriously? Okay, close but off enough to be ridiculous, IMHO. Just use <Files \.ht> and be done with it.
order allow,deny
deny from all
satisfy all
</Files>
<IfModule mod_speling.c>
[rant #4]
The definition of an idiot is someone who repeatedly does the same thing expecting a different result. Asking Apache to confirm the existence of ANY module with an <IfModule> ... </IfModule> wrapper is the same thing in the webmaster world. DON'T BE AN IDIOT! If you don't know whether a module is enabled, run the test ONCE then REMOVE the wrapper as it is EXTREMELY wasteful of Apache's resources (and should NEVER be allowed on a shared server).
[/rant 4]
In my usage, I've not had to turn this on, only include it as a module in Apache.
</IfModule>
# disable directory browsing
Options All -Indexes
<files wp-config.php>
order allow,deny
deny from all
</files>
Whew! Sorry for the "abuse" but you asked whether it was safe or not and that demands explanations. You know me well enough to know the "abuse" isn't personal AND that I tend to get pedantic - especially about mod_rewrite code!
Reply With Quote
Bookmarks