If a person goes to my site and type a URL like www.mysite.com/admin/includes, the webpage displays the entire directory! How can I stop this? Most of the files are in PHP though, so even if anyone downloads those files, they're mostly blank, but someone just hacked my website and I'm wondering if knowing the directory structure helped them.
I need to do disable the viewing of all directory structures, while allowing the display of images like www.mysite.com/images/image1.jpg
In your .htaccess file, insert the following line:
Options -Indexes
This will prevent the viewing of directory indexes, whilst allowing actual files to pass through.
Note that you must have AllowOverride Options set in your config (this is already done in most hosting environments).
Related
How can I prevent people from viewing my files, when they browse my website?
I wish to prevent users from reading the files present at, say, http://domainname.com/css/. When they do that, all the files in that folder are visible to the user.
You can change the permissions on that folder or move it out of public_html folder on server
Put a dummy index.html file into the folder.
If you're using an Apache web server, you can use the -Indexes option in your server configuration to disable directory indexing.
I'm trying to display simple HTML files in a folder on my web site. No ASP.NET, no application, just a virtual directory. I'm getting "Access denied" in the browser when I try to open a web page.
This is through a hosting provider; I have access through FTP and IIS Manager only.
Authorization Rules show Allow - All Users - Inherited.
I'm far from an expert on IIS, and most search results either suggest checking folder permissions in the file system (which I have no direct access to) or are relevant to applications.
How can I diagnose this?
More information:
Through trial and error, I found out the cause, and worked around it with URL Rewrite. I'd still like to know why it's happening (the root cause) and how to change IIS's behavior.
I'm moving my site from Linux hosting to Windows hosting. Some of the old URLs are of the form:
http://www.MYSITE/myblog/index.php/2013/04/29/SOMEFILE.html
The ones I'm moving are HTML files, not PHP files, but I tried to mirror the folder structure.
The problem is in the index.php folder name. No matter what I do, even if I enable directory browsing, IIS won't let me access any files in a folder with that name. If I rename the folder (or even the "extension" part), it all works.
I've scanned through many of the IIS settings and haven't found any mention of forbidding a .php extension. What's going on?
You need to add permission for IIS users.Try adding permission to the folder by adding user
IIS_IUSRS and give required permission .
1.Right click on folder, go to properties
2.Go to security tab
3.Click on Edit, if you don't see IIS_IUSRS in the user list who have permission
4.Click on Add , In the box , add IIS_IUSRS and click on check names, it will
get the qualified name .
5.Click OK and apply
Hopefully it should work then
Through trial and error, I found out the cause, and worked around it with URL Rewrite.
For URLs of the form:
http://www.MYSITE/myblog/index.php/2013/04/29/SOMEFILE.html
The problem is in the index.php folder name. IIS won't let me access any files in a folder with that name. If I rename the folder (or even the "extension" part), it all works.
This is reminiscent of Joomla virtual (SEO) URLs. I'm assuming that you don't really have static files at all, but the CMS program running your site parses this information after the "index.php" as parameters for a database query to create the html page on the fly. In this case, the only file that's really being served by the web server is index.php, and the program includes other php files depending on the parameters entered. You're on the right track though, with creating a small file on the destination server and try to load it, but this means the index.php directory structure is moot.
I hope you can help me, I have a website and constantly the .htaccess file is hacked to redirect to another page, every time I delete that file, when I check the file after 5 minutes, again the file is written to redirect to a page with malware, I changed passwords of sftp, the page itself and the database several times from different computers with windows and linux but this file is constantly changed in the main page and creating hacked .htaccess in the subdirectories, Why does this keep happening? HELP
The web page is hosted in Dreamhost.
If the permissions on your .htaccess file are set so that only you can modify it, then you will find one of the following:
An entry in your FTP access log showing .htaccess being uploaded
An entry in the control panel access log showing the .htaccess being edited
An entry in your HTTP access log at the time that the modification happens (often a POST, but not necessarily). This is often to a generalised backdoor process of some sort.
A crontab entry that makes this modification
Additionally, you will find that your site was hacked somehow - e.g. insecure version of JCE editor, poor passwords, nonumber extensions, flash uploader, failure to update for known security problems, or similar. It's all in the logs. You will also find that there are a stack of little PHP files or an extra admin account which will let the attacker back once you sort out the obvious part of the problem.
I have yet another .htaccess question, simple for you, not so much for me.
Let's say my main site is found at http://domain.com. I do all of my pre-release testing at sandbox.domain.com and sandbox.domain.co. I just realized that Google has gone ahead and indexed my sandbox sites... Ugggh!
The document root folder on my Apache server with the live site is always called ALIVE, and in order to make my sandbox contents live I quickly rename the folders, ie ALIVE->OLDx, SANDBOX->ALIVE.
My goal is to prevent indexers and users from accessing my sandbox pages. I am trying to design a .htaccess file for document root that only allows my ip address when accessed from a sandbox subdomain (sandbox.domain.com), otherwise it allows everyone when accessed from the main domain (domain.com). This would eliminate the process of remembering to update the .htaccess file each time I release a new site.
This doesn't seem too difficult, but I haven't been able to find the right combination. Any pointers in the right direction will be much appreciated!
Create a .htaccess inside each folder (like sandbox):
order deny,allow
deny from all
allow from YOUR IP HERE
I'm building a website, but I'm not entirely sure what to do with the .htaccess file.
Say for example I have a folder called pages which holds all my pages, can i deny access to someone if they type in www.website.com/pages so that they can't see the directory?
I've tried putting the .htaccess file in the pages folder with the "deny from all" line and although it denies access, it's also denying access to the actual pages.
Is there a way to do this without denying access to see the pages on the website, just denying access to the directory?
Sorry if this doesn't make much sense, I'm so confused lol.
Thanks for any help.
If you don't want Apache to display the list of files in the directory, you can use
Options -Indexes
To disable the indexes feature.
See the Options Directive section of Apache's manual, for more informations.
Else, an "easy way" would be to just put an empty index.html or index.php file -- i.e. a default file that Apache uses when one is trying to access a directory.
About that, see the DirectoryIndex Directive.
Just put an empty index.html in the directory.
Most hosts I've used do it with the IndexIgnore * directive.
just put that in a .htaccess file and drop it into the folder you want to block indexing of.
More info: Apache IndexIgnore Documentation.
You can log into your site manager and then you can use you index manager to say which folder you would like to protect. I just did mine