A nice .htaccess protection mechanism

I have taken some lines from one of my general .htaccess protection files and explained them line by line. I also have added some great links that will help you get on your way.


Basics:
The RewriteCond directive defines a single condition (test for it) If so, then the system will in sted do the following
RewriteRule.

You can stack several conditions in a row, one per line.
The # acts like a comment

============== Start ===================
# mod_rewrite in use

RewriteEngine On
#ByD - This turns on the rewrite function

# Redirect all non www to www
RewriteCond %{HTTP_HOST} !^www\. [NC]
#ByD - this is using the server variable HTTP_HOST and using regex to check when there is not "www."
#ByD - the [NC] means that we are testing for any case
#ByD - if this is true then we stop and go find the very next ReWriteRule and execute it

RewriteRule (.*) http://www.%{HTTP_HOST}/$1 [R=301,L]
#ByD - this is the very next RewriteRule
#ByD - This takes every character (.*) and replace it with the http://www. then the domain and then a / and the rest of what was there
#ByD - The [R=301,L] means redirect the client and send a 301 status code (R=301) and make this the last rule (L).


RewriteCond %{QUERY_STRING} \.\./ [OR]
#ByD - this starts a new set of RewriteCond
#ByD - this first one loooks at the query_string variable - (all the prameters after the "?") and checks for the occurance of ./
#ByD - again if this is true then we stop and go find the very next ReWriteRule and execute it
#ByD - the [OR] means that the remaining test Rewrite conditions are tested with a logical OR and not the standard AND

RewriteCond %{QUERY_STRING} (https?|ftp)(\:|\%3A) [OR]
#ByD - this look in query_string for https or ftp or the urlencoded version of ./
#ByD - again if this is true then we stop and go find the very next ReWriteRule and execute it
#ByD - the [OR] means that the remaining test Rewrite conditions are tested with a logical OR and not the standard AND

#ByD - there are many more conditions some good ones you can fine for WP are here:
# .htaccess Plugin Blocks Spam, Hackers, and Password Protects Blog


#ByD - After all of your RewriteCond yo uwil lwant to send the user/hacker some where. Many send them this
RewriteRule .* - [F,NS,L]
#ByD - this will send a 403 FORBIDDEN
#ByD - I do not like that becasue it tells the hacker that you know what he did and you spanked him for it
#ByD - I believe in trying not to upset the hacker or give him a challange. I Usually just give them this
RewriteRule ^(.*)$ index.php [L]
#ByD - this will just send him back the home page. Maybe he made an error, who know but it is innocent.

========= Finish =================


A great .HTaccess cheat sheet can be found here:
mod_rewrite Cheat Sheet (V2) - Added Bytes


There is a good WP plugin for this too :
WordPress Firewall Plugin » SEO Egghead



Here is a great set of WP rules (some are just for anything)

# Deny exploit using bogus graphics
RewriteCond %{HTTP:Content-Disposition} \.php [NC]
RewriteCond %{HTTP:Content-Type} image/.+ [NC]
RewriteRule .* - [F,NS,L]

# Deny requests with no host header
RewriteCond %{REQUEST_URI} !^/(wp-login.php|wp-admin/|wp-content/plugins/|wp-includes/).* [NC]
RewriteCond %{HTTP_HOST} ^$
RewriteRule .* - [F,NS,L]

# Deny bad content type
RewriteCond %{REQUEST_METHOD} =POST
RewriteCond %{HTTP:Content-Type} !^(application/x-www-form-urlencoded|multipart/form-data.*(boundary.*)?)$ [NC]
RewriteCond %{REQUEST_URI} !^/(wp-login.php|wp-admin/|wp-content/plugins/|wp-includes/).* [NC]
RewriteRule .* - [F,NS,L]

# Deny common exploits
RewriteCond %{REQUEST_URI} !^/(wp-login.php|wp-admin/|wp-content/plugins/|wp-includes/).* [NC]
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ ///.*\ HTTP/ [NC,OR]
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /.*\?\=?(http|ftp|ssl|https):/.*\ HTTP/ [NC,OR]
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /.*\?\?.*\ HTTP/ [NC,OR]
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /.*\.(asp|ini|dll).*\ HTTP/ [NC,OR]
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /.*\.(htpasswd|htaccess|aahtpasswd).*\ HTTP/ [NC]
RewriteRule .* - [F,NS,L]

# Deny unsafe characters
RewriteCond %{REQUEST_URI} !^/(wp-login.php|wp-admin/|wp-content/plugins/|wp-includes/).* [NC]
RewriteCond %{THE_REQUEST} !^[A-Z]{3,9}\ [a-zA-Z0-9\.\+_/\-\?\=\&]+\ HTTP/ [NC]
RewriteRule .* - [F,NS,L]


I hope this helps you and others - Stay Stay safe and hack free,

Kevin