Preconfiguredhtaccess

DaJoomla!Documentation.

AnApachewebserverusesanhtaccessfileinthesitemaindirectoryforsitespecificconfiguration.A
preconfiguredhtaccessfile(htaccess.txt)isdeliveredwithJoomla.Itcontainsinstructionstoavoid
commonexploitsandimplementsSEFurls.Inadditionitprovidessomesettingsthatneedstobe
checkedforyourenvironment:
IndexIgnore*
Options+FollowSymLinks
OptionsIndexes
RewriteBase/
Activatinghtaccess.txtmeansmerginganexisting.htaccessfilewithhtaccess.txtanddecideonthe
settingsmentionedabove.
Note:
Theactivefileissetinoneofthehttpd.conffileswith:
AccessFileName.htaccess

Itdefaultsto.htaccess(whichmakesithiddenonaUnixlikefilesystems).Noneedtochangethat.
OntheWindowsplatformyoumightchangeitto:
AccessFileNamehtaccess.ini

soyoucanedititmoreeasily.
Don'tusehtaccess.txtherebecausewhenupdatingJoomla,itwillbeoverwrittenandchangeswillbe
lost.
Contentofhtaccess.txt:
##
#@packageJoomla
#@copyrightCopyright(C)20052015OpenSourceMatters.Allrightsreserved.
#@licenseGNUGeneralPublicLicenseversion2orlaterseeLICENSE.txt
##
##
#READTHISCOMPLETELYIFYOUCHOOSETOUSETHISFILE!
#
#Thelinejustbelowthissection:'Options+FollowSymLinks'maycauseproblems
#withsomeserverconfigurations.Itisrequiredforuseofmod_rewrite,butmay
already
#besetbyyourserveradministratorinawaythatdisallowschangingitin
#your.htaccessfile.Ifusingitcausesyourservertoerrorout,commentitout
(add#to

#beginningofline),reloadyoursiteinyourbrowserandtestyoursefurl's.If
theywork,
#ithasbeensetbyyourserveradministratorandyoudonotneeditsethere.
##
##Nodirectorylistings
IndexIgnore*
##Canbecommentedoutifcauseserrors,seenotesabove.
Options+FollowSymlinks
OptionsIndexes
##Mod_rewriteinuse.
RewriteEngineOn
##BeginRewriterulestoblockoutsomecommonexploits.
#Ifyouexperienceproblemsonyoursiteblockouttheoperationslistedbelow
#Thisattemptstoblockthemostcommontypeofexploit`attempts`toJoomla!
#
#Blockoutanyscripttryingtobase64_encodedatawithintheURL.
RewriteCond%{QUERY_STRING}base64_encode[^(]*\([^)]*\)[OR]
#Blockoutanyscriptthatincludesa<script>taginURL.
RewriteCond%{QUERY_STRING}(<|%3C)([^s]*s)+cript.*(>|%3E)[NC,OR]
#BlockoutanyscripttryingtosetaPHPGLOBALSvariableviaURL.
RewriteCond%{QUERY_STRING}GLOBALS(=|\[|\%[09AZ]{0,2})[OR]
#Blockoutanyscripttryingtomodifya_REQUESTvariableviaURL.
RewriteCond%{QUERY_STRING}_REQUEST(=|\[|\%[09AZ]{0,2})
#Return403Forbiddenheaderandshowthecontentoftheroothomepage
RewriteRule.*index.php[F]
#
##EndRewriterulestoblockoutsomecommonexploits.
##BeginCustomredirects
#
#Ifyouneedtoredirectsomepages,orsetacanonicalnonwwwto
#wwwredirect(orviceversa),placethatcodehere.Ensurethose
#redirectsusethecorrectRewriteRulesyntaxandthe[R=301,L]flags.
#
##EndCustomredirects
##
#Uncommentfollowinglineifyourwebserver'sURL
#isnotdirectlyrelatedtophysicalfilepaths.
#UpdateYourJoomla!Directory(just/forroot).
##
#RewriteBase/
##BeginJoomla!coreSEFSection.
#
RewriteRule.*[E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
#

#Iftherequestedpathandfileisnot/index.phpandtherequest
#hasnotalreadybeeninternallyrewrittentotheindex.phpscript
RewriteCond%{REQUEST_URI}!^/index\.php
#andtherequestedpathandfiledoesn'tdirectlymatchaphysicalfile
RewriteCond%{REQUEST_FILENAME}!f
#andtherequestedpathandfiledoesn'tdirectlymatchaphysicalfolder
RewriteCond%{REQUEST_FILENAME}!d
#internallyrewritetherequesttotheindex.phpscript
RewriteRule.*index.php[L]
#
##EndJoomla!coreSEFSection.