WordPress Plugin for Apache .htaccess Security

Brand New Features for 4.x

1. gzip's previous .htaccess file and sends it as an attachment to the logged in users email account along with password user setup.
2. Provides a AA_PP_DEBUG constant that you can set to 1 for verbose debugging
3. Now also works for sites running on SSL (PHP version >4.3.0)
4. Rewrote the security module code in the form of snort, nessus, and mod_security rules and signatures
5. Added a *real* check to see if mod_rewrite is installed
6. Added Modules that remove directoryindexes
7. Added Module to require SSL (only enabled for SSL blogs, so you don't shoot yourself in the foot)
8. Added Module that only allows certain REQUEST_METHOD in the request
9. Much more on the way..

Example WordPress Generated .htaccess

Password Protecting wp-admin

# BEGIN AskApache PassPro
# sid900
AuthName "Protected By AskApache"
AuthUserFile /askapache.com/.htpasswda1
AuthType Basic
Require valid-user
 
<filesMatch ".(ico|pdf|flv|jpg|jpeg|png|gif|swf|css|js)$">
Allow from All
</FilesMatch>
 
<files async-upload.php>
Allow from All
</Files>
Satisfy Any
# sid900
# END AskApache PassPro

Blog root .htaccess

# BEGIN WordPress
<ifModule mod_rewrite.c>
RewriteEngine On
RewriteBase /blog/
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /blog/index.php [L]
</ifModule>
 
# END WordPress
 
# BEGIN AskApache PassPro
 
<ifModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
 
# sid1000
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /blog/wp-content/.*$ [NC]
RewriteCond %{REQUEST_FILENAME} ^.+.php$
RewriteRule .* - [F,NS]
# sid1000
# sid1010
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /blog/wp-includes/.*$ [NC]
RewriteCond %{REQUEST_FILENAME} ^.+.php$
RewriteRule .* - [F,NS]
# sid1010
 
</ifModule>
 
# sid1005
<files wp-login.php>
AuthName "Protected By AskApache"
AuthUserFile /askapache.com/.htpasswda1
AuthType Basic
Require valid-user
</Files>
# sid1005
 
# END AskApache PassPro

SID .htaccess Security Modules

If you have any ideas for some more, please let us know!

January 1st, 2008

« Boost SEO, Drive Traffic with the 404 Error Page PluginLets win the DreamHost Contest »

Comments Welcome