Apache .htaccess file

This configuration file sets HTTP security headers for a website to protect against common attacks like clickjacking, XSS, and man-in-the-middle attacks. It uses Apache's mod_headers module to add these protective headers to every response sent to visitors' browsers. Most lines are already active, but there's one powerful Content Security Policy line commented out that requires careful testing before enabling.

This configuration block uses Apache's FilesMatch directive to target two specific image files by their names and then blocks all access to them by denying requests from every client. It's a way to hide or protect those particular files from being served to anyone who requests them.

This snippet blocks all requests that don't match common static file extensions like images, stylesheets, and fonts. It's a security measure that denies access to any URL that doesn't end with one of the explicitly allowed file types.

These rules tell the web server to block direct access to certain file types and folders. The first three lines list out which files are allowed to pass through (images, stylesheets, JavaScript, fonts), and then line 5 forbids everything else, effectively preventing people from browsing to directories or accessing files that aren't explicitly whitelisted.

This Apache configuration block prevents direct access to hidden files and directories (those starting with a dot, like .htaccess or .git) by checking if they exist on the server and returning a 403 Forbidden error if someone tries to access them. It's a security measure to keep sensitive configuration and version control files hidden from the public.

This Apache configuration snippet intercepts requests for files ending in .tex, .log, or .aux and forces the web server to tell browsers these are plain text files, regardless of what the files actually contain. This prevents browsers from trying to interpret or download these development/LaTeX files in unexpected ways.

This configuration forces PDF files to download as attachments instead of opening in the browser. When a user requests a PDF, the server tells their browser to treat it as a generic binary file and present a download dialog rather than attempting to display it.

This Apache configuration file automatically redirects all incoming requests to use HTTPS and add 'www.' to the domain name if it's missing. It does this in two separate steps—first forcing HTTPS, then adding www—because some security certificate services prefer it that way.

This configuration block sets up error handling for PHP by hiding errors from users while still recording them to a log file. It only applies if the PHP 5 module is loaded on the server, and it tells PHP to track which errors occur so they can be logged for debugging purposes.

This configuration block sets up error handling for PHP by enabling error display and logging. It tells the web server to show errors to users, log them to a file, and track which errors occurred—but only if the PHP 5 module is actually installed and active on the server.

This htaccess snippet redirects all incoming requests to a maintenance.php page, but only for visitors whose IP addresses aren't on a whitelist. It's a common way to put a website in maintenance mode while allowing specific people (like developers) to access the real site.

This configuration file enables compression of web content to reduce file sizes and improve load times. It tries two different Apache compression methods: first mod_deflate (the modern standard), and if that's not available, it falls back to mod_gzip (an older alternative). Each method is configured to compress specific file types like HTML, CSS, JavaScript, fonts, and images, while avoiding compressing content that's already compressed.

This Apache configuration file sets up browser caching rules to improve website performance. It tells browsers how long to keep different types of files (like CSS, images, fonts, and videos) before requesting fresh copies from the server. Static files like fonts and images are cached for a year, while dynamic content like HTML and JSON aren't cached at all since they change frequently.

This file contains two different syntax examples for blocking all access to a directory using Apache's access control rules. The first uses Apache 2.2's older 'Deny' directive, while the second shows the newer 'Require' directive syntax for Apache 2.4 and later. Only one should be uncommented depending on your server version.

This file configures Apache web server access control in two different ways, showing both the old Apache 2.2 syntax and the newer Apache 2.4 syntax. It sets up a whitelist where all traffic is blocked by default, except for requests coming from a specific IP address.

This snippet uses Apache's mod_headers module to add a security header that prevents browsers from trying to guess the type of content being served. By setting X-Content-Type-Options to 'nosniff', we're telling the browser 'trust what I tell you this file is, don't try to be clever about it', which prevents certain types of attacks where a malicious file might be misinterpreted.

This configuration block adds security headers to responses for executable files like Perl scripts, PHP pages, and CGI programs. It tells browsers not to embed these pages in frames and to block cross-site scripting attempts, protecting against common web vulnerabilities.

This .htaccess file locks down a directory by preventing any scripts from running. It does this in two ways: first by telling the web server to stop treating certain file types as executable scripts, and second by explicitly denying all web access to those dangerous file types.

This snippet disables directory listing in Apache. When someone tries to visit a folder URL without specifying a file, instead of seeing a list of files in that directory, they'll get a forbidden error. It's a common security practice to hide what files are on your server.

This htaccess configuration sets up HTTP Basic Authentication (a username/password login prompt) for a specific file called confidential.md. It tells the web server to look up user credentials from a password file and only allow authenticated users to access that file.

This snippet configures HTTP Basic Authentication for a folder, requiring visitors to log in with a username and password before accessing any files inside. It tells the web server to prompt for credentials, names the protected area, points to a password file, and ensures only authenticated users can proceed.

This Apache configuration file blocks access to all files except image files with specific extensions (.png, .jpg, .jpeg, .gif, .svg, .ico). The actual denial rules are commented out, showing examples for both older Apache 2.2 syntax and newer Apache 2.4 syntax.

This .htaccess rule tells the web server to permanently redirect all traffic from the current site to a new domain. Anyone visiting the old site will be automatically sent to the new location, and search engines will update their records accordingly.

This rule tells the web server to permanently redirect any request for /old.php to a new URL at http://www.yoursite.com/new.php. Browsers and search engines will remember this redirect and update their bookmarks or records accordingly.

This line tells the web server to permanently redirect any requests for /old.php to a new location at http://www.yoursite.com/new.php. The 301 status code signals to browsers and search engines that this is a permanent move, so they'll update their records accordingly.

This rule tells the web server to permanently redirect any URL that starts with '/category/' to the same path without that '/category/' prefix. For example, a request to '/category/products' would redirect to '/products'. The '301' status code tells browsers and search engines this is a permanent move, so they should update their bookmarks and search indexes accordingly.

This rule tells the web server to permanently redirect any request starting with '/fruit/' to '/fruits/' instead, keeping whatever comes after 'fruit/' in the URL. It's useful when you've renamed a folder or want to send traffic from an old URL path to a new one.

This rule redirects any URL starting with 'archive/2020/' to just '2020/', keeping whatever comes after the date intact. It's a permanent redirect (301) that helps maintain SEO value when you reorganize your site's folder structure.

This configuration tells search engine crawlers not to index or follow links on pages in this directory. It does this by adding a special HTTP header that search engines check before deciding whether to catalog your content.