Zen Follower
- Join Date:
- Feb 2007
- Posts:
- 104
- Plugin Contributions:
- 0
Completely confused about htaccess and SSL
I'm so frustrated I could just cry. I thought I was doing well, figured out MANY problems over the past months in Zen without having to bug the folks on the message boards too awful much, and thought I'd have the store open this week. But now I'm starting to fear that after all this time and work I will wind up going back to my old html site with Mal's e-commerce cart (which is truly cumbersome to maintain).
What it all boils down too is, I am absolutely too stupid to understand anything related to the htaccess files, no matter how much I read. I've given up on trying to get a permanent redirect to work and can accept that, but the security issues are something else entirely.
I have read and re-read the Important Site Security Recommendations file, section 7, regarding htaccess. There are already htaccess files in most of the folders of my default Zen installation (version 1.3.7) which I didn't put there, but some of them don't have what the article suggests to put in them, which is;
#.htaccess to prevent unauthorized directory browsing or access to .php files
IndexIgnore /
<Files *.php>
Order Deny,Allow
Deny from all
</Files>
#add the following to protect against people discovering what version your spiders.txt file is
<Files *.txt>
Order Deny,Allow
Deny from all
</Files>
I don't know which of the pre-existing htaccess files to delete, which ones to leave alone, or which ones to add the suggested commands to.
For examples, my Includes folder has an htaccess file that has the "<Files*.php>..." section shown above in it, but none of the subfolders inside of the Includes folder do... does that single htaccess file take care of all the subfolders too then?
The htaccess file in the Admin folder doesn't have anything even resembling the two htaccess commands(?) above in it... so do I add them? The public_html folder iteself doesn't have those two either... does it need them?
There are four folders inside the public_html folder that don't have an htaccess file at all by default... do I need to make one?
I am beyond confused, and I know that there are people on the boards who are going to either ignore this post as a "dumb question" or tell me to read the instructions, but the point is, I have read and I just do not understand it at all.
