Commenting .htaccess code
Comments in the .htaccess file are allowed on a per-line basis, each line of comments is preceded by the # (pound) sign. Comments running over several lines require thus multiple # signs. It’s also advised to use only letters, numbers, dashes, and underscores in the comments. This safe practice will contribute in avoiding potential server parsing errors.
Enable Basic Rewriting
To ensure mod_rewrite (basic rewriting) is enabled on your site, add the following line to your site’s root htaccess file:
# enablebasicrewriting RewriteEngineon
Enable Symbolic Links
Enable symbolic links (symlinks) by adding the following directive to the .htaccess file.
# enablesymboliclinks Options +FollowSymLinks
Some webhosting companies may have swapped FollowSymLinks to SymLinksIfOwnerMatch due to security reasons. Check with your provider which directive should be used.
What is order allow,deny?
Order allow,deny is a setting in your Apache web server configuration that is used to allow or restrict access.
The allow directive affects who can access an area of the server or website. Access is usually controlled by hostname, IP address, or IP address range.
The deny directive restricts access to the server. Restrictions can be based again on hostname, IP address, or environment variables.
Order allow,deny tells your server that the allow rules are processed before the deny rules. If the client does not match the allow rule or it does match the deny rule, then the client will be denied access.
Order deny, allow means that the deny rules are processed before the allow rules. If the client does not match the deny rule or it does match the allow rule, then it will be granted access.
Deny Access to .htaccess
Any attempt to access the .htaccess file will result in a 403 error message.
Deny Access to Multiple File Types
To restrict access to certain file types, add the following code and edit the file types you wish to protect. As you might notice you need to escape the dot (.) this is done by typing a backslash (\) in front of the character that needs escaping.
Disable Directory Browsing
If your site does not have default index page everything within the root of your site will be accessible to all visitors. Disabling directory browsing will instruct the server to display a "403 Forbidden - Authorization Required" message for any request to view a directory.
# denydirectorybrowsing OptionsAll -Indexes
To enable directory browsing, use the following directive:
# allowdirectorybrowsing OptionsAll +Indexes
The following rule will prevent the server from listing directory contents:
# denyfolderlisting IndexIgnore *
The IndexIgnore directive can also be used to prevent the display of select file types:
Deny Access to a Specific Directory / Folder
Restricting directory / folder access is probably one of the most frequently used .htaccess techniques. To deny all requests for the restricted directory or folder, prepare a .htaccess file in that directory and put the following directive in it:
# denydirectoryaccess denyfromall
Allow access from a certain IP (where xxx.xxx.xxx.xxx is your IP):