I am creating a new website and I want to make it as secure as possible. I was preparing to do some things with .htaccess and I'm semi-concerned about the security level it provides. Can someone (ex: a stranger online) access it? Can an .htaccess file can be cracked/hacked? How secure should I feel in using this for hiding directory content and such? Is it consistantly reliable, or a security risk?
3
-
"...using this for hiding directory content and such?" - If this directory content is sensitive/critical then it probably shouldn't be stored in the public HTML space to begin with.– MrWhiteJan 8, 2019 at 16:47
-
@MrWhite Where do you store sensative information (ex: membership data) then?– elbrantJan 8, 2019 at 17:04
-
Outside of the public HTML space. eg. Above the document root. (Assuming you weren't planning on using Apache's HTTP authentication to secure the directory?)– MrWhiteJan 8, 2019 at 19:04
Add a comment
|
2 Answers
If your website does get hacked, most attackers modify the .htaccess file to reroute traffic off your site or to power pages with their own files.
While .htaccess isn't usually the security problem, it will likely get used as part of any hack. Disabling .htaccess could make your site less desirable to hack, or limit the damage that a hacker can do.
answered Jan 7, 2019 at 19:08
htaccess files usually can not be accessed and this can be verified in the httpd file of the server, which should have a rule to deny access to htaccess files.
htaccess files are widely used for seo and webmaster's purposes and are considered a staple when it comes to a variety of things (controlling access, redirecting, etc).
So, htaccess is reliable and you should feel safe using it. Keep in mind though that this is not the best practice, as the apache documentation suggests using httpd file for user authentication and mod_rewrite tasks as it is less taxing on the server and thus increases performance. It is just that many webmasters are not necessarily their server's admins and thus they don't have rights to modify the httpd file, so they are granted access to httaccess files for the specific directories their web application resides in.
In the end, there is no concern when it comes to using htaccess files (exluding server performance but this depends on what you want to do) and it is a widely used method by many webmasters. The file is protected from the public by a deny access rule in your httpd file (if you can not verify it yourself, ask your server admin to check it) and even in the case it is not, someone would have to have specific rights to be able to modify it.
That being said, it all depends on your server's security. An exposed/compromised server can in no way guarantee the integrity of your htaccess file, or any file for that matter. But the htaccess, on its own, is not known to pose a security risk.
