How to create .htaccess files?

[bgroup99]

Hi,

As per item 7 of the site security recommendations I am trying to set up .htaccess files to secure my site. I have determined that my host enables cascading .htaccess files. Now I would like to create and upload a .htaccess file.

My questions is: how do I create this file? Do I simply paste:

#.htaccess to prevent unauthorized directory browsing or access to .php files
IndexIgnore */*
<Files *.php>
Order Deny,Allow
Deny from all
</Files>

#add the following to protect against people discovering what version your spiders.txt file is
<Files *.txt>
Order Deny,Allow
Deny from all
</Files>

into a file and save it and then upload it? Do I simply name it .htaccess?

Thanks for your help,

Nate

[azrahn]

Hi,

My questions is: how do I create this file? Do I simply paste:
into a file and save it and then upload it? Do I simply name it .htaccess?
Nate

Hi Nate.

You are correct. This is exactly how to do it
Please check that the apache user does not have write access.

For more info regarding .htaccess purpose and syntax etc.
http://en.wikipedia.org/wiki/Htaccess

Ronald.

[bgroup99]

Please check that the apache user does not have write access.

Thanks for your help Ronald. Just one follow up question: how do I check that the apache user does not have write access? Who is the apache user?

Thanks,

Nate

[azrahn]

Hi,

The apache user is the account the apache webserver is using.
Which account is being used depends on your webserver setup.
If you chmod to 644 all wil be fine

Ronald.

[bgroup99]

Hi and thanks again.

I created a .htaccess, which I have attached to this message. (I had to rename it to htaccess.txt to attach it).

I uploaded this file to my root directory as my host has cascading enabled and set CHMOD to 644.

Nate

[DrByte]

If you uploaded that to your "root" directory, then you should find that your store stops working immediately.

You blocked *.php with that, so "index.php" should be disabled.


So ... if "root directory" means in your "public_html" folder, then you should not be able to access your index.php, meaning your site will be inaccessible. If that's the case then at least you know the file is "working" ... but in the wrong place.
Follow the security guidelines for the appropriate places to put these restrictions.

[bgroup99]

Yeah, I found that out the hard way. I moved the .htaccess file to admin/includes and now everything seems to be working.

Thanks,

Nate