Category: Webservers

Discourage HTTPS On WordPress

January 16, 2013

Recently we had a WordPress site where that used HTTPS (SSL) on the login/admin areas. But we wanted to discourage HTTPS for non-admin URL. Here are the rewrite rules that ended up using in a .htaccess file:


RewriteEngine On
RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} !^\/wp\-admin
RewriteCond %{REQUEST_URI} !^\/wp\-login.php
RewriteCond %{REQUEST_URI} !^\/wp\-includes
RewriteCond %{REQUEST_URI} !^\/wp\-content\/plugins
RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [R,L]

RewriteEngine On

RewriteCond %{HTTPS} on

RewriteCond %{REQUEST_URI} !^\/wp\-admin

RewriteCond %{REQUEST_URI} !^\/wp\-login.php

RewriteCond %{REQUEST_URI} !^\/wp\-includes

RewriteCond %{REQUEST_URI} !^\/wp\-content\/plugins

RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [R,L]

Block PHP Execution With .htaccess In Folder

January 5, 2013

For a server using Plesk add the following lines to a .htaccess file to stop execution of PHP scripts in the folder:


RemoveHandler .php .phtml .php3
RemoveType .php .phtml .php3
php_flag engine off

RemoveHandler .php .phtml .php3

RemoveType .php .phtml .php3

php_flag engine off

I like to use this to protect cache and image upload folders that are writable by the web server but should not be able to execute code. As a further precaution, chown the .htaccess to root, so it can’t be overwritten by Apache or FTP, and “chattr +i” to be sure about it.

Redirect Old URLS In .htaccess

December 20, 2012

Frequently when our clients upgrade their website, they will need URLs from the old site mapped to the new site. So for example maybe they had this URL on the old server: http://acme.com/widgets/egonomic-widget-design Maybe there are many sites on the Internet that link to this URL so they don’t want it to return a 404 error. Instead they want it to redirect to the new address of the article at: http://acme.com/smallwidgets/designing-egonomic-widgets This can be accomplished with a simple rewrite rule in the .htaccess file like this: RewriteEngine On Rewriterule ^widgets\/egonomic-widget-design$ http://acme.com/smallwidgets/designing-egonomic-widgets [R=permanent,L] Note that the RewriteRule should be on one line in the file … not wrapped over two lines. The pattern for the rewrite rule is:


RewriteRule [source patter] [destination] [options]

RewriteRule [source patter] [destination] [options]

Also notice that in the source pattern we escaped the slash (/) with a backslash (\). This is necessary since the slash has special meaning in a regular expression. In the above

Install SSL Certificate – Apache / CentOS / RHEL

December 18, 2012

For this example we’ll install an SSL certificate for acme.com. The certificate authority is Network Solutions. The procedure may be different for other certificate authorities especially in how intermediate certificates are setup. Install mod_ssl if needed

yum install mod_ssl

1	yum install mod_ssl

Copy SSL certificate to the server – The certificate should be named after the domain name and placed in the /etc/pki/tls/certs folder. For our example the cert will be:

/etc/pki/tls/certs/acme.com.crt

1	/etc/pki/tls/certs/acme.com.crt

Copy the intermediate CA bundle to the server – The bundle should be placed in /etc/pki/tls/certs/ and named after the certificate authority. For example, GoDaddy would be “gd_bundle.crt” and Network Solutions would be “ns_bundle.crt”. Sometimes the certificate authority will provide the bundle file. Other times they will just provide a set of separate root and intermediate CA certificates. In this situation, you’ll need to create the bundle file yourself. The bundle is a text file with a series of certificates. The first certificate

Rewrite Rule To Block User Agent

November 28, 2012

Recently we’ve seen servers being overloaded by the 80legs.com web crawler. Here’s a quick rewrite rule that can be placed in .htaccess to block 80legs:


RewriteCond %{HTTP_USER_AGENT} 80legs
RewriteRule .* - [F,L]

RewriteCond %{HTTP_USER_AGENT} 80legs

RewriteRule .* - [F,L]

Here’s a rule to block by user agent with Nginx:


if ($http_user_agent ~ "80legs") { return 403; }

if ($http_user_agent ~ "80legs") { return 403; }

Reliable Penguin provides managed web hosting, systems administration, website and server migrations, and expert consulting.

Recent Updates

Fixing WP‑CLI “eval()’d code” Parse Errors on PHP 8.4 During “wp db import”

Force a 404 With a CloudFront Function (Always)

HTTP Basic Auth Is Dead

WordPress 6.8 Speculative Loading Can Break HTTP Basic Auth

Zero‑Trust for WordPress Admin with Cloudflare Access (Email One‑Time Codes)