Some other cheatsheets

• https://gist.github.com/ankurk91/ee339291c6666dcba794

Tester:

• https://htaccess.madewithlove.be/

General

# Block indexing
Header set X-Robots-Tag "noindex, nofollow"

# Don't list files / directories
Options -Indexes

#Caching time is in seconds
	# 1 Week
	<filesMatch "\.(ico|pdf|flv|jpg|jpeg|png|gif|js|swf|svg|woff)$">
		Header set Cache-Control "max-age=604800, public"
	</filesMatch>

Deny access to a directory (put code in htaccess within)

Deny from all

Typical WordPress htaccess:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

# Speed up - permits concurrent reqs on same connection
<IfModule mod_headers.c>
Header set Connection keep-alive
</IfModule>

# Custom 404
ErrorDocument 404 /custom-error.php

Setting headers (mod_headers)

Apache Docs - https://httpd.apache.org/docs/current/mod/mod_headers.html

General syntax:

Header set {header-name} {header-value}

Common needs:

• Restrict Iframe embedding to same-origin
  • Header always append X-Frame-Options SAMEORIGIN

Rewriting URLs

Standard Redirects

General syntax:

Redirect {code} {from} {to}

Example:

Redirect 301 /p/other.html /other/

mod_rewrite

Some cheatsheets:

• https://mod-rewrite-cheatsheet.com/
• whoishosting

General syntax using mod_rewrite:

<IfModule mod_rewrite.c>
	RewriteEngine On
	RewriteCond {...}
	RewriteRule {...}
</IfModule>

Logic:

RewriteCond act as AND by default; if you have three RewriteCond lines and then a RewriteRule, the rule won't execute unless all three of the preceding conditions match. However, you can use the OR flag ([OR]) with RewriteCond.

Flags:

Misc examples:

Example: Force HTTPS

# Force HTTPS
RewriteCond %{SERVER_PORT} 80 
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R,L]

Redirect from subdomain to main

This is especially important with CPanel, as the default behavior with "addon" domains is to actually make it a subdomain of the domain set as the CPanel root (usually the first domain purchased). This makes it very easy to end up with duplicate content... see this and this.

<IfModule mod_rewrite.c>
	RewriteEngine On
	# Force addonDomain.mainDomain.com to addonDomain.com
	RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)\.mainDomain\.com [NC]
	RewriteRule (.*) https://%1.com/$1 [R=301,L]
</IfModule>

<IfModule mod_rewrite.c>
	RewriteEngine On
	# Force mail.mainDomain.com to mainDomain.com
	RewriteCond %{HTTP_HOST} ^(?:www\.)?mail\.(.+)\.com [NC]
	RewriteRule (.*) https://%1.com/$1 [R=301,L]
</IfModule>

File handlers / mocking

Usually this is necessary when trying to dynamically generate images / tracking pixels. There are a few options.

For one, you can simply use a rewrite rule to route the request from /image.gif to serve image.php.

Or, the more advanced way:

• AddHandler will let you tell the server to process a file extension with a different handler than usual.
  • To process .gif
    • AddHandler application/x-httpd-php-stable .gif
• AddType tells the server to map extensions to a different mime type, which can also affect how it gets processed
  • Example: AddType image/png .png
  • To process .gif
    • AddType application/x-httpd-php .gif

Depending on which option you have used, you might also need to explicitly set the MIME type in your response to the incoming request. This would be code dependent, but in PHP, usually looks like header("Content-Type: image/gif")

Disable mod_security stuff for WP

<IfModule mod_security.c>
  SecFilterEngine Off
  SecFilterScanPOST Off
</IfModule>