CODEWITHSUNDEEP
apache.htaccesssecuritysshftp
Johnny
Johnny

Reputation: 612

Can a .htaccess file be hacked?

On a subdomain I want to use only a .htaccess file for redirects. No PHP, no database or something else will be used. Can a .htaccess file still be hacked? What should I do to protect it?

Upvotes: 2

Views: 4463

Answers (2)

Nadir Latif
Nadir Latif

Reputation: 3773

The apache2.conf file has following lines by default which prevent viewing of htaccess files:

#
# The following lines prevent .htaccess and .htpasswd files from being
# viewed by Web clients.
#
<FilesMatch "^\.ht">
        Require all denied
</FilesMatch>

Upvotes: 2

user2493235
user2493235

Reputation:

It will not be visible under standard Apache setup which blocks all files starting with.ht from being served. So nobody will be able to view the contents or get at it through the Apache front-end. Take the usual precaution of having it be 644 permissions and not owned by the user that Apache runs as. No extra security needed outside of protecting your server generally.

Check that the standard protection is in place, so it can't be viewed. Easiest way is just to try visiting it in a web browser. You should get a 403 forbidden.

If you're worried you could put the rules in the main server config instead. I wouldn't worry as long as the above is in place.

Upvotes: 1

Related Questions