Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Removing the dot or period from htaccess files (and thus making it unhidden) - A dangerous move?

I tried to search in Google with the string: Can I remove the dot htaccess But I didn't find anything directly related to this question.

The reason for removing it is one and simple --- To edit it faster directly from the FTP client instead of navigating to the Cpanel file manager...

share|improve this question
1  
You can remove the dot or the period, but not both. Make sure you leave at least one of them otherwise the file will no longer work as intended. – Tim N. Butdim Feb 21 at 4:15
    
My guess is that if '.htaccess' becomes 'htaccess', it will be visible on 'domain.com/htaccess'. If Apache works like standard Linux does, changing to 'htaccess' is possible as you would just need a symbolic link with '.htacces' pointing at the visible file. However I highly suspect it will be visible to all. As to what the security implications of this are - well, I don't know. Setting up the server and ftp/sftp client properly so that you see hidden files would possibly be the better choice as others indicated. – DetlevCM Feb 21 at 8:54
2  
This is just wrong. The dot is the period. – Andrew Lott Feb 21 at 13:01
up vote 14 down vote accepted

It's dangerous in the sense that it won't work if you do. Apache will look for .htaccess and apply those rules as it serves content. Without finding that file, Apache will proceed assuming no additional directives are necessary.

.htaccess includes a leading . because it's a "hidden file" in Linux systems (which run most web servers).

share|improve this answer
4  
And yes, as @FiascoLabs mentioned, you should be able to set your FTP client to show hidden files if you regularly need to edit that. There will sometimes be a setting called "LIST parameters" where you can add -al to show them. – Andrew Lott Feb 20 at 23:10
3  
FWIW you can change the name of the file that Apache looks for with the AccessFileName directive (which defaults to .htaccess). – w3dk Feb 20 at 23:53
    
Yes, but only if you have access to the Apache config. I presumed this was a shared hosting platform based on the cPanel mention. – Andrew Lott Feb 21 at 0:13
3  
And server changes made for trivial reasons often have unintended consequences down the line. Changing the hidden file view in a client is more appropriate. – Fiasco Labs Feb 21 at 1:56
    
You can use a symbolic link to .htaccess if you want to serve it. Then you can control the name and location. – PyRulez Feb 21 at 3:36

Your FTP client has a setting to show hidden files. Turn it on. Or use a client that allows . hidden files to be seen.

And use SFTP as FTP sends clear-text credentials (clear-text => unencrypted as in you can retrieve them by running tcpdump or similar traffic analysis and capturing the packets).

share|improve this answer

Removing the dot or period from htaccess files and thus making it unhidden - A dangerous move?

You definitely have to be careful how you do it, as you might otherwise compromise the security of your server.

There are basically two dangers that you could encounter:

Reading your htaccess File

htaccess files are nothing special, and if you just rename .htaccess to htaccess, anyone can now read it, as it will be served as a normal file by Apache. It doesn't matter here if you changed AccessFileName or not. Access to .htaccess is denied by these lines in your Apache config, which will not catch htaccess:

<FilesMatch "^\.ht">
    Require all denied
</FilesMatch>

This may have negative consequences, such as leaking of information. Your htaccess file may for example contain absolute paths, and possibly other sensitive information such as database passwords defined via SetEnv.

htaccess File not working

Of course, if you rename your .htaccess file, it will not be parsed anymore. This means that you have to change AccessFileName.

But if you just change AccessFileName .htaccess to AccessFileName htaccess, this might be dangerous, as some other applications on the same server may rely on .htaccess files being parsed. There are quite a few applications whose security heavily relies on .htaccess files being parsed properly, for example because it denies access to files containing passwords, uploaded PHP files, etc (relying on .htaccess files being parsed isn't ideal, but it does happen frequently).

Doing it right: Adding additional .htaccess file names

If you want to rename your .htaccess file, you have to do two things:

Add the new name to AccessFileName (do not remove the default .htaccess name):

AccessFileName .htaccess htaccess

And add a deny rule for it:

<FilesMatch "^htaccess">
    Require all denied
</FilesMatch>

[it isn't quite clear to me if you want to rename your htaccess file permanently or just temporarily while editing it, but the dangers I described above apply in either case, as does the solution proposed]

share|improve this answer

Removing the dot is renaming the file. Once you do that, the web server won't be able to find the file, so its contents will no-longer effect web server behavior.

If after considering all the disadvantages of running a non-standard set-up you you still want to rename, it you can configure apache to look for the file under a different name, but it may make sense to make the name clearly different to .htaccess

eg: to change it to www.config add this to your web-server's configuration:

AccessFileName www.config

However the apache documentation recommends not using .htaccess at all, and doing all configuration in the server configuration file.

share|improve this answer
3  
Make sure you include instructions on how to block access from the renamed .htaccess file from being served out by the webserver. Security conscious hosting providers often block .htaccess from being readable by web clients. – Fiasco Labs Feb 21 at 7:01

No, you should not do this. It is dangerous, incorrect, and the wrong answer to the problem.

  1. If you remove the dot, it changes it to a different filename. Apache is programmed specifically to look for the filename with the dot, so it won't see your renamed file as being anything special. Your server config commands in the file won't get loaded, and your site probably won't work as intended. This can be worked around by making changes to the core Apache config, but obviously only if you have access to it (which you probably don't if you're on shared hosting), but in general it's best not to change that kind of thing.

  2. If you remove the dot, then the file will become accessible to web browsers, thus making key parts of your server config visible to hackers and potentially giving them information that will help them attack you. It is possible to work around this and make sure the file remains hidden, but that involves further messing around in the main server config.

  3. Your FTP client will have a setting that allows you to see hidden files. (if it doesn't, get yourself a better FTP client!)

  4. While we're talking about FTP -- don't use it. Always use SFTP instead. the "S" stands for "Secure". If you're using FTP without the 'S', you're not secure. (unbelievably, there are some web hosting companies that only give you FTP access, not SFTP. If you're on one of them, find a better hosting company as soon as you can).

share|improve this answer

Your web host ( or Apache server ) will not be able to detect it is a ".htaccess" file, instead, it will see it as a file with no extension.

So, I wouldn't say its DANGEROUS, but it certainly would not operate correctly, or at all.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.