Secure your site with htaccess

Некоторые правила в файле .htaccess могут значительно уменьшить количество "опасных" запросов на вашем сайте и отразить атаки скрипткиддисов.

#Base rules of anti mysqli and another
RewriteCond %{QUERY_STRING} (\|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(globals|encode|localhost|loopback).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(request|select|insert|union|declare|drop).* [NC,OR]
RewriteCond %{QUERY_STRING} concat[^\(]*\( [NC,OR]
RewriteCond %{QUERY_STRING} union([^s]*s)+elect [NC,OR]
RewriteCond %{QUERY_STRING} union([^a]*a)+ll([^s]*s)+elect [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(\[|\]|\(|\)|<|>|’|"|;|\?|\*).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(&#x22;|&#x27;|&#x3C;|&#x3E;|&#x5C;|&#x7B;|&#x7C;).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(%0|%A|%B|%C|%D|%E|%F|127\.0).* [NC,OR]
RewriteCond %{QUERY_STRING} .*=http.*(\:|%3A) [NC,OR]
RewriteCond %{QUERY_STRING} .*=https.*(\:|%3A) [NC,OR]
RewriteCond %{QUERY_STRING} .*=ftp.*(\:|%3A) [NC,OR]
RewriteCond %{QUERY_STRING} .*=sftp.*(\:|%3A) [NC,OR]
RewriteCond %{QUERY_STRING} .*jos_.* [NC,OR]
RewriteCond %{QUERY_STRING} .*users\+where\+gid.* [NC,OR]
RewriteCond %{QUERY_STRING} .*proc/self/environ.* [NC,OR]
RewriteCond %{QUERY_STRING} .*union\+select.* [NC,OR]
RewriteCond %{QUERY_STRING} .*perl\+.* [NC,OR]
RewriteCond %{QUERY_STRING} .*curl\+.* [NC,OR]
RewriteCond %{QUERY_STRING} .*SQL.* [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [NC,OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [NC]
RewriteRule .* - [F] 


#Remote File Inclusion Protection
RewriteCond %{QUERY_STRING} ^.*=(ht)|(f)+(tp)+(://|s://)+.*(\?\?)+ [NC]
RewriteRule .* - [F]

#XSS Protection
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*iframe.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [NC,OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ http://frost.de/trap.php [R,L]
RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK) [NC,OR]
RewriteCond %{THE_REQUEST} ^.*(\\r|\\n|%0A|%0D).* [NC]
RewriteRule .* - [F]

##Some else
RewriteCond %{QUERY_STRING} etc/passwd [NC,OR]
RewriteCond %{QUERY_STRING} echo.*kae  [NC,OR]
RewriteCond %{QUERY_STRING} boot\.ini  [NC,OR]
RewriteCond %{QUERY_STRING} \=\\%27$   [NC,OR]
RewriteCond %{QUERY_STRING} \=\\\'$    [NC,OR]
RewriteCond %{QUERY_STRING} \.\./      [NC]
RewriteRule .* - [F]
RedirectMatch 403 (base64|crossdomain|localhost|wwwroot|e107\_)
RedirectMatch 403 (eval\(|\_vti\_|\(null\)|echo|config\.xml)
 
 
## Disallow access to htaccess.txt, configuration.php, configuration.php-dist and php.ini
RewriteRule ^(htaccess\.txt|configuration\.php(-dist)?|php\.ini)$ - [F]

## Disallow PHP Easter Eggs (can be used in fingerprinting attacks to determine
## your PHP version). See http://www.0php.com/php_easter_egg.php and
## http://osvdb.org/12184 for more information
RewriteCond %{QUERY_STRING} \=PHP[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} [NC]
RewriteRule .* - [F]

.htaccess for Joomla:
http://docs.joomla.org/Htaccess_examples_%28security%29