.htaccess is one file that every web admin should know and understand. At its basic level, it controls access to your site’s directories. But there is much more than you can do, as the snippets in this post will show you.
If you you would like to learn the basics of
.htaccess, you should check our Introduction to .htaccess article, which explains pretty well everything you will need to get you up and running.
1. Controlling Access to Files and Directories
Password protection is one thing, but sometimes you may need to completely block users from having the option of accessing a particular file or directory. This usually happens with system folders, such as the
includes folder for which applications will need access, but no users will ever need the privilege.
To do this, paste this code onto an
.htaccess file and drop it in the directory:
However, this will block access to everyone, including you. To grant yourself access, you need to specify your IP address. Here is the code:
xxx.xxx.xxx.xxx is your IP. If you replace the last three digits with
0/12 for example, this will specify a range of IPs within the same network, thus saving you the trouble to list all allowed IPs separately.
If you want to block access to a particular file, including
.htaccess itself, use the following snippet instead:
Similarly, if you want to allow given IPs, list them with
If you want to block access to particular file types, use this instead:
2. Disabling Directory Browsing
To prevent directory browsing, add this:
However, if for some reason you want to enable directory browsing, change it to the following:
3. Speeding-Up Load Times by Compressing Files
You can compress any type of file, not only images. For instance, to compress HTML files, use this:
To compress TEXT files, use this:
4. Protect Your Site against Hotlinking
If you don’t want your images hotlinked, add this to your
Just replace yourdomain.com with your own, and you are good to go.
5. Blocking Visitors Referred from a Particular Domain
If you have users from a particular domain you don’t welcome, you can ban them from your site. For instance, if your site gets listed in a place you don’t want traffic from (i.e., adult sites, blackhat sites, etc.), you can serve them with a 403 Forbidden page. You need to have
mod_rewrite enabled, but you should be fine since it is usually on. Add this snippet:
You need to replace
bannedurl2.com etc. with the domain names you want to blacklist. You may want to use the
[NC] flag because it specifies that the domain name you’ve entered isn’t case sensitive. The
[F] flag specifies the action to take – in this case to show the 403 Forbidden error. If you want to ban multiple sites, use the
[NC,OR] flag for every domain but the last and if you want to ban a single domain use only the
6. Blocking Requests from Particular User Agents
If your log files show particular user agents (bots or spiders) you can add a few lines to
.htaccess and deny them access to your site:
badbot1, etc. with the names of bots from your log files. This should keep such programs away from your site.
7. Caching Files
Another way to speed your site’s load times is via file caching. Here is what you need to add in order to cache files:
You can add more file types (or remove some of them) to the sequence of files listed in this example – do what suits you. You can also use
max-age to specify the amount of time in seconds that your files will live in the cache.
8. Disabling Caching for Particular File Types
If you don’t want to cache particular file types, it is easier not to include them in the cache sequence. However, sometimes files might get cached even if you don’t explicitly list them there, and in this case, you may want to disable caching only for them. Most often, you will want to disable caching for dynamic files, such as scripts. Here is how to do it:
Just pipe the files you want caching disabled for, and this is it.
9. Bypassing the Download Dialogue
By default, when you try to download a file from a Web server, you get a dialogue that asks you if you want to save the file or open it. This dialogue is especially irritating with large media files or PDFs. If the files you have uploaded to your server are for downloads, you can save users the trouble and proceed straight to download. Here is what you need to set in
10. Renaming an
If for some reason, mostly security-related, you want to rename your
.htaccess file, it is very easy to do it. In theory, renaming an
.htaccess file shouldn’t cause problems with the applications running on your server but if by chance you notice such issues after you rename the file, just rename it back to its original name.
You also need to update any entries in the file itself or everywhere
.htaccess is mentioned; otherwise you will be getting lots of errors.
11. Changing a Default Index Page
If you want your index page to be something different from the default
index.htm, etc. this is very easy to do. Here is what you need to add to
mypage.html with the actual URL of the page you want to use as index and you are done.
12. Redirecting to a Secure https Connection
If you are using HTTPS and you want to redirect users to the secure pages of your site, use this:
13. Restricting File Upload Limits in PHP, Maximum Size of Post Data, Max Script Execution Time, etc.
.htaccess allows you to set some values that directly affect your PHP applications. For instance, if you want to impose upload limits in PHP so that you don’t run out of hosting space because of large files, use this:
Of course, you can set the value to anything you deem appropriate – 15M (MB) in this example isn’t fixed in stone. You can also restrict the maximum post size for uploading in PHP. To do it, add this:
Similarly, you can change
10M to any value that suits you. If you don’t want scripts to execute forever, you can limit their execution time with the help of the following:
240 is the number of seconds before the script will be terminated, and as you guess, it could be any value. Finally, if you want to limit the time a script can parse input data, use this:
And set any value in seconds that suits you.
14. Disguising File Types
Sometimes, you wouldn’t like users to know the file types of the files on your site. One way to hide this information is if you disguise them. For instance, you can make all your files look as if they are HTML or PHP files:
There is much more that can be done with
.htaccess. For instance, you can set automatic translation of your site’s pages, or set the server timezone, or remove the www from URLs, or use fancy directory listings, etc. In any case, before you start experiments with
.htaccess, always backup the original
.htaccess, so if things don’t go as planned, you have a working copy to revert to.