We want to avoid our own users from hotlinking to images and media outside our own domain. Is there a way to do this through IIS (version 8 on Windows Server 2012) ? We have the URL Rewrite module installed, but unsure how to develop a rule that would accomplish what we need.
Pleaes keep in mind I'm wanting to block any hotlinking to other websites, and only allow images/media that are located on our own domain. Googling and searching here on stackoverflow results in preventing other sites from hotlinking to one's own self hosted content, not the other way around like we want.
WMSAuth plugin for Windows Media Services might be something which you might look at. It's not for IIS but you might use the same concept for building your solution.
It's open source so you can check the sources on github.
Related
everyone.
I need to lock website for downloading via some windows tools and wget.
The site consists of js, html and php files.
I googled about security resource sharing, but it did not helpful for me.
Thank you.
As long as at the same time you need to have your website online available for everybody, this is not possible. If someone visits your site, the browser needs to access all files, in other words download them. You might be able to apply a few hacks to make it more difficult, but you can not prevent it completely.
If you want to restrict it to a defined audience, you can implement a login using for example HTTP Auth. How this can be achieved depends on your hosting. It might be doable using an .htaccess file in your web root or maybe through the admin interface of your hoster.
Your PHP file should be safe by the way, the above said applies to the public parts of your site (HTML/CSS/JavaScript/Images/...).
Right I'll try and explain my situation as thoroughly as possible while also keeping it brief...
I'm just starting out as a web designer/developer, so I bought the unlimited hosting package with 123-reg. I set up a couple of websites, my main domain being designedbyross.co.uk. I have learnt how to map other domains to a folder within this directory. At the minute, one of my domains, scene63.com is mapped to designedbyross.co.uk/blog63 which is working fine for the home page. However when clicking on another link on scene63.com for example page 2, the URL changes to designedbyross.co.uk/blog63/page2...
I have been advised from someone at 123-reg that I need to write a .htaccess file and use the RewriteBase directive (whatever that is?!) I have looked on a few websites to try and help me understand this, including http://httpd.apache.org/docs/2.0/mod/mod_rewrite.html however it all isn't making much sense at the moment.
Finally, scene63.com is a wordpress site, whether that makes any difference to how the htaccess file is structured I'm not sure...
Any help will be REALLY appreciated - Thanks.
I run my personal public website on Webfusion, which is another branded service offering by the same company on the same infrastructure, and my blog contains a bunch of articles (tagged Webfusion) on how to do this. You really need to do some reading and research -- the Apache docs, articles and HowTos like mine -- to help you get started and then come back with specific Qs, plus the supporting info that we need to answer them.
It sounds like you are using a 123 redirector service, or equivalent for scene63.com which hides the redirection in an iframe. The issue here is that if the links on your site use site-relative links then because the URI has been redirected to http://designedbyross.co.uk/blog6/... then any new pages will be homed in designedbyross.co.uk. (I had the same problem with my wife's business site which mapped the same way to one of my subdirectories).
What you need to do is to configure the blog so that its site base is http://scene63.com/ and to force explicit site-based links so that any hrefs in the pages are of the form http://scene63.com/page2, etc. How you do this depends on the blog engine, but most support this as an option.
It turned out to be a 123-reg problem at the time not correctly applying changes to the DNS.
new to dreamhost here and have followed the wiki on this but still need some additional help if possible. I want to be able to preview a site while I work on it, before I point the live domain to my dreamhost server. I've added the domain via the Control Panel, and all my files sit in the directory, /home/user/mysite.com - which is correct I think. When trying to follow the wiki with regards the mirroring details, I find that the only option I have is as follows, where I can't change any of these details:
Create the mirror at: mysite.com
Mirror this site: existingsite.com
The existingsite.com is just a live site sitting on the same server space. Is there something I'm missing here? Probably a newb mistake no doubt :)
Mirroring is for you to point a domain to an existing site. Hence this means you can mirror on 1 site. ie. both existingsite.com and mirrorsite.com points to the same server space.
If you want to create a development site, you probably are talking about 2 installations.
In this case, a quick and dirty trick I use is to create a development subdomain, dev.existingsite.com and fully host it. You normally get a /home/user/dev.existingsite.com folder with this. When your site is fully ready, you can edit your fully hosted existingsite.com and point the web directory to dev.existingsite.com. A better way is to SSH in and move the files.
There's an option copy files over in the settings page. Anyway dreamhost live help is pretty good. This is definitely something they will answer.
If I buy a hosting (+ domain) service for the website of a friend of mine, and then I decide to use the remaining web space and mysql databases for my development and test...
is google caching my development websites (in other folders and sub-urls) under his website ?
What's the downside to develop on a server with already a production website.. ? I was thinking to create a tiny url linking to a www.myfriendwebsite.com/mydevelopmentSite.. in order to hide the real url.
Thanks
If you don't link to it or don't submit to google or list in a sitemap -- google won't find it.
But, you could also just use a robots.txt to tell google not to index it.
http://en.wikipedia.org/wiki/Robots_exclusion_standard
Update: to stop google and malicious bots:
Put a directory in robots.txt using *, and then put your site in a hard to guess subdirectory of that directory -- also, don't keep directory browsing on.
Also -- don't link to it anywhere, but perhaps you can't stop others from linking -- in that case, only robots.txt will keep you out of google. Malicious bots can get the site from the link.
Your hosting provider may have forbidden that in his Terms of Service (mine has). Other than that, I'd go for a subdomain instead of a subdirectory (like mydevelopmentsite.myfriendswebsite.com).
Note: I originally posted this on ServerFault, but I haven't gotten any responses at all. Since it looks like I'm on track to get the Tumbleweed badge over there, I figured I would try here also.
Our existing public website consists of a mish-mash of asp.net pages with mostly static content and some real web applications that are set up as virtual directories. We're now looking at installing Umbraco, which requires that you install it at the root of the website.
Since the CMS would be at the root of the website, I'm assuming it's a bad idea to run our existing pages and web applications underneath Umbraco (due to the URL rewriting it performs and inheriting web.config settings, etc.) So how do we make everything co-exist peacefully both while we transition to the CMS and after we're finished?
My only idea so far was to set up the CMS and the applications as separate websites and then use some sort of URL rewriting/reverse proxy to make everything resolve correctly:
* www.example.com would keep resolving to our old homepage
* www.example.com/dept1 would keep resolving to the old dept1 page
* www.example.com/dept2 would resolve to the new dept2 page on the CMS
* www.example.com/app would resolve to an existing web application
We ending up setting up Umbraco as it's own website in IIS and then we bought ISAPI Rewrite so that we could seamlessly pass through CMS content for certain URLs.