Hot answers tagged

5

You can do this using mod_rewrite near the top of your .htaccess file. In its simplest form this would be something like: RewriteEngine On # Remove "index.html" RewriteRule (.*)index\.html$ /$1 [R=301,L] The regex (.*)index\.html$ matches any URL-path that ends with index.html and captures the part of the URL-path before index.html. The $1 ...


5

It could be possible to write some custom fail2ban rules to 95% solve this (ie with a short "findtime"). There might be edge cases with CGNAT and scripts but you can likely mitigate this by being specific about the form page to scan for, and it should be practical if your form is not getting 1000s of hits per hour from a targeted group. That said, ...


4

RewriteRule ^post/article\.php$ {C:1}/{C:2}/{C:3}/{C:4} RewriteRule ^([^/]+)/([^/]+)/([^/]+)/([^/]+)/?$ post/article.php?a=$1&b=$2&c=$3&id=$4 RewriteRule ^sitemap\.xml?$ sitemap.php If used in .htaccess these directives would result in a malformed internal rewrite - possibly a rewrite-loop (500 Internal Server Error response). If used ...


4

<VirtualHost *:80 *:2030> Separate the vHosts, so that port 2030 has its own container and implement a site-wide redirect in that container to port 80 (or HTTPS/443?). For example: <VirtualHost *:2030> ServerName example.com ServerAlias www.example.com # Redirect everything to port 80 Redirect 301 / http://example.com/ </...


3

Just a few notes regarding your existing directives: RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_FILENAME} !-l RewriteRule ^pdfs/([^/]*)/([^/]*)/([^/]*)/([^/]*)$ /pdftools/openpdf.php?file=$1&task=$2&dsp=$3&id=$4 [L] RewriteRule ^pdfs/([^/]*)/([^/]*)/([^/]*)$ /pdftools/openpdf.php?file=$1&task=$2&dsp=$3 [L] RewriteRule ^...


3

I want to have public/user_profile/show_user.html/4 RewriteRule ^show_user.html/(\d+)$ show_user.php?id=$1 [NC,L] Assuming public/ is the document root and this .htaccess file is in the document root then you are missing /user_profile from the start of the RewriteRule pattern. For example: RewriteRule ^user_profile/show_user\.html/(\d+)$ show_user.php?id=$1 ...


3

I don't think you can on that install. From looking at the demo and reading https://forum.aapanel.com/d/20-how-to-manage-dns it looks like DNS manager is a plugin (that is only compatible with some Linux variants to boot). So the answer would be to make sure your OS Variant is CentOS7 or higher, you get the DNS Plugin from the store and go from there. I ...


3

EDITED: This is a known php hack. If your server runs Wordpress only, plugins like Wordfence can detect and clean the infected files but if you have other php applications it will take other steps. I ran Maldet and did'n work. It injects or modifies index.php files which call an .ico file, also creates random named .php files The cause can be many including ...


3

I think the "Apache-way" would be to use Server-Side-Includes (SSI) (mod_includes). There does not appear to be a way to access this information with mod_autoindex, nor to output arbitrary variables (that is what SSI is for). For example, in .htaccess: # Enable SSI for .html files (or use .shtml files instead) AddOutputFilter INCLUDES .html # ...


2

Just hit a possibly similar or identical issue though with me it was to update a clients SSL to drop TLSv1 and TLSv1.1 support. The default way is edit ssl.conf and set: SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 This didn't work, but the answer wasn't in ssl.conf or the vhost configuration but rather in Let's Encrypt which has its own Include in (vhost)-le-ssl....


2

Well, its been 2 years so urgent is relative, but yes, you want to fix this as each redirect is believed to come with a small loss of "google juice". Matt Cutts (a google official rep) talked about it being unlikely that Google will follow 4 or more redirects - although that was a while ago (see https://youtu.be/r1lVPrYoBkA?t=165 from about 2:45) ...


2

You could add another condition to the top of the list of conditions. For example: RewriteCond %{REQUEST_URI} ^/episodes/ RewriteCond %{HTTP_USER_AGENT} .... : The RewriteRule that follows will then only be applied when the requested URL starts with /episodes/.


2

File extension "removal" This piece is supposed to remove .php from any and all urls. It ADDS a .php to the end of every .php url. So my urls turn into "file.php.php" RewriteCond %{REQUEST_FILENAME} !-d RewriteRule ^(.*)$ $1.php [NC,L] That code is incorrect/incomplete. In fact, that code by itself would result in an endless rewrite-...


2

You'll need SSL certs that cover the subdomains if users are going to be requesting the subdomain over HTTPS - there is no other way around this without the user getting a browser warning (or failure to connect). In order for me to try and mimic subdomains, I have the following rewrite rule which is currently disabled. #RewriteRule ^(.*)$ http://example.com/...


2

To my mind, there are two ways to approach this problem. The first way is what you're already doing, i.e., trying to do everything with mod_rewrite. This is totally fine for small, simple projects but if your project grows in size or complexity, it can become unwieldy to develop and maintain. The second option is to have your application manage the rewrites, ...


2

Your RewriteCond is incidentally valid but fundamentally wrong. For the URL https://example.com/?amp=1, the characters /? are not part of the %{QUERY_STRING} value, which is amp=1 in fact. I said 'incidentally valid' because in your regex, / is neutralized by ?, so there is a match with amp=1. To achieve your goal, in the simplest case, especially without ...


2

I fear from the phrasing of your question that you might be unaware of the very substantial security implications. Don't do this lightly on an Internet facing server. There are a few ways of doing this. The "Apache level" way is to set up "cgi" functionality in Apache. One way to do this us to add a stanza like below to your Apache config:...


2

It is public as soon as it becomes accessible from a public address. All you need is to forward a port from your gateway to your local machine. You need to find out your external IP address. It could be static in which case, it will not change which makes things easier or it could be dynamic. In any case you have to configure your gateway to accept an ...


2

There's no magic bullet here, if you are blocking "bad bots" based on the User-Agent string then you need to match on a sufficiently unique substring as to not conflict with other bots and users. But will such an approach unintentionally block good ones as well? Not if you've chosen a sufficiently unique substring to match against. HOWEVER, "...


2

To clarify what @StephenOstermiller mentioned in comments, nothing has changed in this regard for quite literally decades. Any question you find on the Stack Exchange network, regarding canonical redirects on Apache, will be just as relevant now it was "back in the day". There is also no single "correct" solution. Due to the variation of ...


2

I think SecRuleEngine directive set to DetectionOnly should help. There will be no disruptive actions like blocking. This directive should help you debug/analyze rules before going live on production. Ref: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#SecRuleEngine The directive is present in version 3 as well.


2

Since you are using a custom header, adding a small piece of JavaScript to the header file should help. For example, below JS code in the custom header will modify the h1 tag (custom defined) to show the current URL. <h1 id="path"></h1> <script> document.getElementById("path").innerHTML = "Index of " + window....


2

The issue was my own misunderstanding of how Nginx works with Apache. The .htaccess rules appear not to work because they are never invoked as the request is handled by Nginx thus never reaches Apache. For anyone else using Cloudways, it is not possible at this time for custom Nginx rules to be added through the user control panel, the SSH console or by the ...


2

A pattern and argument is missing to your RewriteRule line. You also probably can simplify this rule like the following: # if the path is "/omialab/omia-linea-erboristica-prodotti-erboristici-per-il-corpo-olio-di-mandorla-argan-jojoba/omia-linea-erboristica-prodotti-erboristici-per-il-corpo-olio-di-mandorla-argan-jojoba.php" # and the query string ...


2

Make a subdomain e.g. dev.example.com, and create your new site in that space. Then when it is finished, simply move all the files to the directory containing your old site. Once you have done that you can repeat the process for other subdomains, but in their own directory...but if they are new subdomains, likely no one knows they exist, so just build them ...


1

What is "duplicate content"? "Duplicate content" is simply where you have two or more different URLs referencing essentially the same resource and are not canonicalising this in some way (eg. with a rel="canonical" element or external redirect). https://example.com/foo/bar and https://www.example.com/foo/bar are two different ...


1

There are three parts to this: Making URLs without an extension work by loading the correct content Redirecting URLs ending in .html to remove the extension Changing all the links in your site so that they don't have the .html The first part is built into the Apache content negotiation module. It has a feature called "Multiviews." That feature ...


1

There is no single answer to this and any way you attack it will likely cause significant pain during the transition. I would focus on the problem you are issue you are trying to solve, rather then ask for how to implement a specific solution. Some possibilities - Use rewrite rules to add .html onto the end of any url received [that doesn't end in .xx .xxx ...


1

You could change RewriteRule ^(index\.html|index\.php)?(.*) to RewriteRule ^(index\.html|index\.php)?(episodes/.*) So that it only matches that directory.


1

You've put your "redirect" directives in the wrong place - they need to go at the top of the file, before the # BEGIN WordPress section. By placing them later in the file (after the WP front-controller) then they are only going to get processed for requests that map directly to physical files and directories (which includes the document root). So, ...


Only top voted, non community-wiki answers of a minimum length are eligible