htaccess require local breaks background images - css

I have my image folder protected from browsing using the following line in my .htaccess file:
require local
This provides the security I require, but prevents CSS background images from displaying.
style="background: url(../data/profile_img/profile_10.jpg?x=1444352490)"
Accessing the file using an img tag works, but css does not.
thanks in advance

I solved this myself.
Turns out my .htaccess was not being honoured at all.
The solution was to remove
+FollowSymLinks from the apache config file, in the directory area
<Directory "/var/www">
AllowOverride All
</Directory>

Related

Apache VirtualHost confusion when using alias

So I have a setup that looks as follows:
www.mydomain.com - runs a complex multisite Wordpress install
www.mydomain.com/othersite - for various reasons this needs to run a totally separate install of Wordpress, but the URL must be in this format for historic reasons.
I'd like the "othersite" install of WP not to have to sit in the directory of the main multisite install, eg
/var/www/main-multisite
/var/www/othersite and NOT /var/www/main-multisite/othersite
My understanding is that I couldn't create a separate virtualhost for othersite, so I created an alias in the main virutalhost:
Alias /othersite /var/www/othersite
However when doing that, it seems the .htaccess file in /var/www/othersite is being ignored - I first noticed this as the permalinks in Wordpress don't work. I tried adding other directives into .htaccess but none work...so I then put gibberish into .htaccess to try and induce an error...but that didn't happen. So taht confirms my thinking that .htaccess is being ignored.
However, if I remove the alias from the Virtual host, and move things so we have
/var/www/main-multisite/other
everything works fine, and the .htaccess in the folder works ok! But this is not how I want things.
Can anyone help me shed any light on what I'm missing here?
Thanks in advance.
After you have set the Alias, you should set the group of directives to apply to the directory. You should add the <Directory> directive in apache config. The default config AllowOverride None will completely ignore .htaccess on the directory. You should also check the documentation about the <Directory> directive.
<Directory "/var/www/othersite">
Options FollowSymLinks Includes
AllowOverride All
Order allow,deny
Allow from all
</Directory>

change default folder for apache

I have installed a Wordpress instance using Bitnami.
Currently 127.0.0.1 takes my to the file in the C:\Bitnami\wordpress-4.4.2-1\apache2\htdocs
I want 127.0.0.1 to take the user to C:/Bitnami/wordpress-4.4.2-1/apps/wordpress/htdocs
Changes i have done:
Edit the httpd.conf file
DocumentRoot "C:/Bitnami/wordpress-4.4.2-1/apps/wordpress/htdocs"
<Directory "C:/Bitnami/wordpress-4.4.2-1/apps/wordpress/htdocs">
Options Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Require all granted
allow from all
</Directory>
Restarted apache server
Still going to 127.0.0.1 shows the index.php page under C:\Bitnami\wordpress-4.4.2-1\apache2\htdocs
What am i missing?
I don't know about Windows, but on my Ubuntu system, I also had to change document root in the sites-enabled/000-default.conf file. Just make sure all configuration files are updated correctly to point to your new document root.
Hope this helps!

Should I use Options -Indexes with Wordpress?

I noticed that if I go to mysite.com/wp-includes/ then it shows all the files in that folder and I would like to disable it (I think that it's a security vulnerability).
After searching online I found an easy solution (adding Options –Indexes in the .htaccess file) but I'm wondering if this may cause any problems with Wordpress or with Google indexing my website?
I use that (along with plenty other htaccess security measures) with all my WordPress sites:
I use:
Options All -Indexes
In my root .htaccess file and have never had issues with either WordPress or search crawlers.
I also have an additional .htaccess file in my /uploads directory for additional security precautions. Some of it may be overkill, so your mileage may vary.
If you want to block from your Apache put this in your virtualhost:
<Directory /var/www/mysite.com/public>
Options -Indexes
AllowOverride All
Require all granted
</Directory>
Restart your apache and it is done.
This very popular security plugin blocks directory listing by adding to htaccess file:
Options -Indexes
According to this answer, this is more secure than:
Options All -Indexes

Override All Wordpress htaccess on server

We've tried a few things that we found around Google for this, but can't seem to get anything to work.
The Problem
We have a server with around 500 Wordpress websites on it. We're trying to lock down all the wp-login.php pages for every instance to the IP address of our office using a global htaccess - but the individual Wordpress htaccess files are overriding this.
The Environment
We're hosted on an AWS Linux server running Plesk to manage each website / Wordpress instance.
The Question
Is there a way we can set one htaccess file on the server to lock down all of the Wordpress login pages without the individual htaccess files overriding this?
any help or suggestions for a good way to do this, would be appreciated.
Thanks in advance
I assume that you have read up on the RewriteOptions directive. As I explain in Tips for debugging .htaccess rewrite rules and as you have found with WP which generates its own .htaccess files, by default the current path is scanned for .htaccess and the rewrite rules in the lowest are applied unless a higher one specifies a RewriteOptions Inherit in which case it's rules are executed after rules specified in the child scope, and this is the catch-22 in that WP access file generates a [L] flag on all its execution paths preventing the parent rules from firing.
So the answer is to do this with an Apache mechanism other than rewrite and you can use the SetEnvIf directive:
SetEnvIf Remote_Addr "!^192\.168\." forbidden
<Files *>
Order allow,deny
Allow from all
Deny from env=forbidden
</Files>
or
SetEnvIf Remote_Addr "!^192\.168\." forbidden
<Directory /var/www/wproot>
Order allow,deny
Allow from all
Deny from env=forbidden
</Directory>
Clearly you'll need to change the Regexp to your local needs but this should do the biz. The Apache docs give other variants on this, but you should be able to find one which works in your case. Just put this in the a per-virtual server context -- within a Directory(Match) directive if necessary -- or in a common parent directory .htaccess file.
I ended up getting this to work with your first suggestion, but actually without the SetEnvIf line being required, so thanks very much! this was my .htaccess in the /var/www/vhosts folder for anyone else needing this:
<files wp-login.php>
order deny,allow
deny from all
Allow from xxx.xxx.xxx.xxx
</files>
Nice and simple and completely different from the previous routes I was trying to take for this.

WordPress is giving me 404 page not found for all pages except the homepage

All of a sudden I go to my WordPress website and all the pages give me a 404 page not found page. I'm assuming the problem lies with the permalink structure, which I could swear I did not touch. The permalink setting is on "month and name."
I've researched similar instances of this problem online and a lot of it has to do with the .htaccess file? I tried finding, but I can't. Perhaps it got deleted somehow? Where is it supposed to be located.
Any suggestions will be helpful
and of course I can see hidden files.
.htaccess is a hidden file, so you must set all files as visible in your ftp.
I suggest you return your permalink structure to default ( ?p=ID ) so you ensure that .htaccess is the problem.
After that, you could simply set "month and name" structure again, and see if it works.
PS: Have you upgraded to 3.1? I've seen some people with plugin issues in this case.
Basically the .htaccess file should exists and the httpd.conf should be correct.
In my case, I changed the file /etc/apache2/apache2.conf in section:
<Directory "/var/www/html">
Line changed is:
AllowOverride None
to
AllowOverride All
And restart the web server with
systemctl restart apache2
Fixing that problem is very simple if you was using permalinks other than the default such as Day and name, Month and name, Numeric, Post name or Custom Structure, you only need to
Login to your admin area: Settings > Permalinks which should be : http://yoursite.com/wp-admin/options-permalink.php
Choose Default permalink setting, then save changes
Then you can return it again to your other previous permalink choice or keep it as default as yo wish
Note that this problem can happen when you move your site from a domain or location to another one.
If the default behavior (example.com/?p=42) is working, you should:
Change to your preferred permalink style: Admin: Settings > Permalinks, and click Save. Sometime it fixes the issue. If it didn't:
Verify that the file /path/to/wordpress/.htaccess has been changed and now includes the line RewriteEngine On. If it doesn't include the line, it's a Wordpress permissions issue.
Verify that the 'rewrite' module is loaded: create a PHP file with
<?php
phpinfo()
?>
in it, open it in the browser and search for mod_rewrite. It should be in the 'Loaded Modules' section.
If it's not, enable it - Look at your apache default index.html file for details - in Ubuntu, you do it with the helper a2enmod.
Verify that apache server is looking at the .htaccess file. open httpd.conf - or it's Ubuntu's alternative, /etc/apache2/apache2.conf. In it, You should have something like
<Directory /path/to/wordpress>
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
</Directory>
After making these changes, don't forget to restart your apache server. sudo service apache2 restart
IF all this dont work, your .htaccess is correct, and permalinks trick didnt work, you may have not enabled your apache2 rewite mod.
I ran this and my issue was solved:
sudo a2enmod rewrite
Within the WordPress admin interface do the following:
Go to admin setting
Click on permalink and select post name in radio button.
Scroll down and you will see .htaccess code here like.
<IfModule mod_rewrite.c>
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /wordpress/index.php [L]
</IfModule>
Copy the code and paste in the .htaccess file.
This error is causing due to disabled of rewrite mod in apache httpd.conf document ,just uncomment it and enjoy the seo friendly permalinks
Check that the directory on .htaccess are the correct
Check the fields "siteurl" and "home" are the correct
We had the same problem and solved it by checking the error.log of our virtual host. We found the following message:
AH00670: Options FollowSymLinks and SymLinksIfOwnerMatch are both off,
so the RewriteRule directive is also forbidden due to its similar
ability to circumvent directory restrictions :
/srv/www/htdocs/wp-intranet/
The solution was to set Options All and AllowOverride All in our virtual host config.
If you have FTP access to your account:
First, login to your wp-admin and go to Settings > Permalinks
You should see something at the bottom that says:
"If your .htaccess file were writable, we could do this automatically, but it isn’t so these are the mod_rewrite rules you should have in your .htaccess file. Click in the field and press CTRL + a to select all."
If this is true do the following:
Go into preferences for your FTP client and make sure hidden files are displayed (varies depending on your FTP client) - If you don't do this you won't be able to find your htaccess file
Go to the folder that your wp-admin, wp-content, wp-includes directories are located. Check for .htaccess file. If it exists skip to step 4
If it does not exist, create a new blank file in your FTP program called .htaccess
Change the CHMOD for your .htaccess file to 666 (your preference on how you want to do this)
Go back to your Permalinks page and edit the link structure you want. Problem should be solved!
Make sure to change the chmod of the htaccess file back to 644 after you are done.
Just had the same problem and it seemed to fix it instantly! Good luck!
Most of the time this issue is fixed by simply visiting the Settings -> Permalink page in the WordPress admin and click Save (as several other answers already pointed out). When this page is accessed, WordPress rewrites the directives in the .htaccess file which magically fixes the issue. The issue often happens after moving a site (the site breaks because the .htaccess gets left behind or the settings need to be updated).
If WordPress doesn't have the right permissions to write the .htaccess file, a notice will appear at the top of the page and further instructions at the bottom when the settings are saved. In this case you need to edit the .htaccess file yourself or, better, to fix the permissions on that file. The file is at the root of the WordPress installation. cd into the directory and sudo chmod 644 .htaccess. You might also want to check if the file belongs to the right group and change that is needed with chown. Ask your hosting provider if you don't know how to do that.
If you are on shared hosting that's probably all you can do. If you still have the issue you might want to talk to you hosting provider's support. Otherwise, make sure the use of .htaccess files is enabled on the server, as #georgeos already suggested. Note that httpd.conf is not always used (Ubuntu indicates it is deprecated but the official Apache docs still says it is often the main configuration file). /etc/httpd/conf/httpd.conf and /etc/apache2/apache2.conf seem to be the most common places for this file. Find the block for the public folder, usually <Directory /var/www/> and make sure that the AllowOverride directive is set to All. If it is set to None, your .htaccess file is simply ignored by the server.
I installed mod_rewrite to fix the issue. Below link provides an installation guide:-
http://www.iasptk.com/enable-apache-mod_rewrite-ubuntu-14-04-lts/
You may have .htaccess disallowed in webhost settings.
Setting to default permalinks would work in that case.
Before trying to do any permalink or server config changes, please check you .htaccess file. This mostly is a corrupt or blank .htaccess file issue. Reset the htaccess file to the default
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
Case 1:- Let us think if migrate site from one hosting to another hosting if see this kind of issue.
Solution:- Simply go to old server copy .htaccess file code, then past in new server .htaccess file. 99% it i will works.
If your WordPress installation is in a subfolder (ex. https://www.example.com/subfolder) change this line in your WordPress .htaccess
RewriteRule . /index.php [L]
to
RewriteRule . /subfolder/index.php [L]
By doing so, you are telling the server to look for WordPress index.php in the WordPress folder (ex. https://www.example.com/subfolder) rather than in the public folder (ex. https://www.example.com).
after 2 long days,
the solution was to add options +FollowSymLinks to the top of my .htaccess file.
I have the same problem and so I remove the Apache and make it again and the problem was solved.
Just Navigate to Settings->Permalink in your dashboard and then Save Changes button in the last.\
I just changed the permalink to 'month and day'of all the posts by ging to setting>permalink.
Now all posts are open and working fine.
Again, I renamed to all posts to its actual permalink. Its again working fine.
This method worked for me :-)
For nginx users
Use the following in your conf file for your site (usually /etc/nginx/sites-available/example.com)
location / {
try_files $uri $uri/ /index.php?q=$uri&$args;
}
This hands off all permalink requests to index.php with a URI string and supplied arguments. Do a systemctl reload nginx to see the changes and your non-homepage links should load.
Go to your WordPress Dashboard, scroll down to settings, select Permalink,
in custom settings that appear, go to custom structure and replace the text in the text field with
/index.php/%year%/%monthnum%/%day%/%postname%/
and then save changes
Wanted to share my two cents. Recently came accross that very same issue installing WordPress 5.9. Year 2021.
Configuration:
Platform MAC, Software XAMPP, WordPress 5.9
None of the previous answer did it for me.
The issue was due to the fact that files permissions accross the XAMPP folder were set to "Read only".
Locate the XAMPP folder. (Usually in the Applications folder).
Right click XAMPP folder.
Get info.
Bottom right unlock button → Follow instructions.
Sharing and permissions → Everyone → Read & Write.
Bottom left three dots button → Apply to enclosed items.
This scenario can also be caused by a database version that's out of sync with the WP files installed on server. Nothing else listed here worked for me; I solved it with a manual WP update.
I had this issue not so long ago. I had reset my permalink to default or just saved it, updated themes/core to (4.7.4)/plugins, deactivated all plugins, switched to default theme, optimized database, .htaccess is already default, checked file permissions, mod_rewrite is on.
So far nothing works, what works are the posts, new page, the /contact page EXCEPT for old pages.
Basically, the pages/URLs that aren't working are:
/breeding
/training
/training/*
/breeding/*
Ultimate, I found these files in the root folder:
/breeding.php and /training.php
I renamed both files and the pages above worked.

Resources