# ---------------------------------------------------------------------- # htaccess von hanabi-pirna # ---------------------------------------------------------------------- # ---------------------------------------------------------------------- # | Komprimierung und Caching | # ---------------------------------------------------------------------- # Serve resources with far-future expires headers. # # (!) If you don't control versioning with filename-based # cache busting, you should consider lowering the cache times # to something like one week. # # https://httpd.apache.org/docs/current/mod/mod_expires.html ExpiresActive on ExpiresDefault "access plus 1 month" # CSS ExpiresByType text/css "access plus 1 year" # Data interchange ExpiresByType application/atom+xml "access plus 1 hour" ExpiresByType application/rdf+xml "access plus 1 hour" ExpiresByType application/rss+xml "access plus 1 hour" ExpiresByType application/json "access plus 0 seconds" ExpiresByType application/ld+json "access plus 0 seconds" ExpiresByType application/schema+json "access plus 0 seconds" ExpiresByType application/vnd.geo+json "access plus 0 seconds" ExpiresByType application/xml "access plus 0 seconds" ExpiresByType text/xml "access plus 0 seconds" # Favicon (cannot be renamed!) and cursor images ExpiresByType image/vnd.microsoft.icon "access plus 1 week" ExpiresByType image/x-icon "access plus 1 week" # HTML - Behält die Website eine Stunde im Cache, neues wird erst nach Ablauf einer Stunde # angezeigt. Wenn nicht gewuenscht, bei 3600 eine Null eintragen ExpiresByType text/html "access plus 3600 seconds" # JavaScript ExpiresByType application/javascript "access plus 1 year" ExpiresByType application/x-javascript "access plus 1 year" ExpiresByType text/javascript "access plus 1 year" # Manifest files ExpiresByType application/manifest+json "access plus 1 week" ExpiresByType application/x-web-app-manifest+json "access plus 0 seconds" ExpiresByType text/cache-manifest "access plus 0 seconds" # Media files ExpiresByType audio/ogg "access plus 1 month" ExpiresByType image/bmp "access plus 1 month" ExpiresByType image/gif "access plus 1 month" ExpiresByType image/jpeg "access plus 1 month" ExpiresByType image/png "access plus 1 month" ExpiresByType image/svg+xml "access plus 1 month" ExpiresByType image/webp "access plus 1 month" ExpiresByType video/mp4 "access plus 1 month" ExpiresByType video/ogg "access plus 1 month" ExpiresByType video/webm "access plus 1 month" # Web fonts # Embedded OpenType (EOT) ExpiresByType application/vnd.ms-fontobject "access plus 1 month" ExpiresByType font/eot "access plus 1 month" # OpenType ExpiresByType font/opentype "access plus 1 month" # TrueType ExpiresByType application/x-font-ttf "access plus 1 month" # Web Open Font Format (WOFF) 1.0 ExpiresByType application/font-woff "access plus 1 month" ExpiresByType application/x-font-woff "access plus 1 month" ExpiresByType font/woff "access plus 1 month" # Web Open Font Format (WOFF) 2.0 ExpiresByType application/font-woff2 "access plus 1 month" # Other ExpiresByType text/x-cross-domain-policy "access plus 1 week" # Insert filters / compress text, html, javascript, css, xml: AddOutputFilterByType DEFLATE text/plain AddOutputFilterByType DEFLATE text/html AddOutputFilterByType DEFLATE text/xml AddOutputFilterByType DEFLATE text/css AddOutputFilterByType DEFLATE text/vtt AddOutputFilterByType DEFLATE text/x-component AddOutputFilterByType DEFLATE application/xml AddOutputFilterByType DEFLATE application/xhtml+xml AddOutputFilterByType DEFLATE application/rss+xml AddOutputFilterByType DEFLATE application/js AddOutputFilterByType DEFLATE application/javascript AddOutputFilterByType DEFLATE application/x-javascript AddOutputFilterByType DEFLATE application/x-httpd-php AddOutputFilterByType DEFLATE application/x-httpd-fastphp AddOutputFilterByType DEFLATE application/atom+xml AddOutputFilterByType DEFLATE application/json AddOutputFilterByType DEFLATE application/ld+json AddOutputFilterByType DEFLATE application/vnd.ms-fontobject AddOutputFilterByType DEFLATE application/x-font-ttf AddOutputFilterByType DEFLATE application/x-web-app-manifest+json AddOutputFilterByType DEFLATE font/opentype AddOutputFilterByType DEFLATE image/svg+xml AddOutputFilterByType DEFLATE image/x-icon # Exception: Images SetEnvIfNoCase REQUEST_URI \.(?:gif|jpg|jpeg|png|svg)$ no-gzip dont-vary # Drop problematic browsers BrowserMatch ^Mozilla/4 gzip-only-text/html BrowserMatch ^Mozilla/4\.0[678] no-gzip BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html # Make sure proxies don't deliver the wrong content Header append Vary User-Agent env=!dont-vary #Alternative caching using Apache's "mod_headers", if it's installed. #Caching of common files - ENABLED Header set Cache-Control "max-age=2592000, public" Header append Vary Accept-Encoding # Set Keep Alive Header Header set Connection keep-alive # If your server don't support ETags deactivate with "None" (and remove header) Header unset ETag FileETag None # ---------------------------------------------------------------------- # | 6g Firewall für Sicherheit - HIER NICHTS AENDERN, ANSONSTEN IST DIE WEBSITE ANGREIFBAR # ---------------------------------------------------------------------- # 6G FIREWALL/BLACKLIST # @ https://perishablepress.com/6g/ # 6G:[QUERY STRINGS] RewriteEngine On RewriteCond %{QUERY_STRING} (eval\() [NC,OR] RewriteCond %{QUERY_STRING} (127\.0\.0\.1) [NC,OR] RewriteCond %{QUERY_STRING} ([a-z0-9]{2000}) [NC,OR] RewriteCond %{QUERY_STRING} (javascript:)(.*)(;) [NC,OR] RewriteCond %{QUERY_STRING} (base64_encode)(.*)(\() [NC,OR] RewriteCond %{QUERY_STRING} (GLOBALS|REQUEST)(=|\[|%) [NC,OR] RewriteCond %{QUERY_STRING} (<|%3C)(.*)script(.*)(>|%3) [NC,OR] RewriteCond %{QUERY_STRING} (\\|\.\.\.|\.\./|~|`|<|>|\|) [NC,OR] RewriteCond %{QUERY_STRING} (boot\.ini|etc/passwd|self/environ) [NC,OR] RewriteCond %{QUERY_STRING} (thumbs?(_editor|open)?|tim(thumb)?)\.php [NC,OR] RewriteCond %{QUERY_STRING} (\'|\")(.*)(drop|insert|md5|select|union) [NC] RewriteRule .* - [F] # 6G:[REQUEST METHOD] RewriteCond %{REQUEST_METHOD} ^(connect|debug|delete|move|put|trace|track) [NC] RewriteRule .* - [F] # 6G:[REFERRERS] RewriteCond %{HTTP_REFERER} ([a-z0-9]{2000}) [NC,OR] RewriteCond %{HTTP_REFERER} (semalt.com|todaperfeita) [NC] RewriteRule .* - [F] # 6G:[REQUEST STRINGS] RedirectMatch 403 (?i)([a-z0-9]{2000}) RedirectMatch 403 (?i)(https?|ftp|php):/ RedirectMatch 403 (?i)(base64_encode)(.*)(\() RedirectMatch 403 (?i)(=\\\'|=\\%27|/\\\'/?)\. RedirectMatch 403 (?i)/(\$(\&)?|\*|\"|\.|,|&|&?)/?$ RedirectMatch 403 (?i)(\{0\}|\(/\(|\.\.\.|\+\+\+|\\\"\\\") RedirectMatch 403 (?i)(~|`|<|>|:|;|,|%|\\|\s|\{|\}|\[|\]|\|) RedirectMatch 403 (?i)/(=|\$&|_mm|cgi-|etc/passwd|muieblack) RedirectMatch 403 (?i)(&pws=0|_vti_|\(null\)|\{\$itemURL\}|echo(.*)kae|etc/passwd|eval\(|self/environ) RedirectMatch 403 (?i)\.(aspx?|bash|bak?|cfg|cgi|dll|exe|git|hg|ini|jsp|log|mdb|out|sql|svn|swp|tar|rar|rdf)$ RedirectMatch 403 (?i)/(^$|(wp-)?config|mobiquo|phpinfo|shell|sqlpatch|thumb|thumb_editor|thumbopen|timthumb|webshell)\.php # 6G:[USER AGENTS] SetEnvIfNoCase User-Agent ([a-z0-9]{2000}) bad_bot SetEnvIfNoCase User-Agent (AhrefsBot|binlar|casper|checkpriv|choppy|clshttp|cmsworld|crawler4j|diavol|DotBot|extract|feedfinder|flicky|g00g1e|harvest|heritrix|httrack|kmccrew|loader|miner|nikto|nutch|planetwork|postrank|purebot|pycurl|python|seekerspider|SemrushBot|siclab|skygrid|sqlmap|sucker|turnit|vikspider|winhttp|xxxyy|youda|zmeu|ZoominfoBot|zune) bad_bot Order Allow,Deny Allow from All Deny from env=bad_bot # 6G:[BAD IPS] Order Allow,Deny Allow from All # uncomment/edit/repeat next line to block IPs deny from 23.254.224.0/21 # wp-login deny from 31.184.238.0/24 # spam kontaktformular deny from 37.115.0.0/16 # spam kontaktformular deny from 41.216.148.0/24 # wp-login deny from 46.118.0.0/15 # spam deny from 46.185.0.0/17 # spam deny from 46.166.136.0/21 # spam kontaktformular deny from 74.208.0.0/16 # wp-login deny from 88.208.0.0/18 # wp-login deny from 89.249.65.0/24 # spam kontaktformular deny from 107.181.78.0/24 # spam kontaktformular deny from 157.7.105.0 # wp-login deny from 176.109.64.0/18 # spam deny from 178.137.0.0/16 # wp-login deny from 185.104.184.0/24 # spam kontaktformular deny from 185.130.184.0/24 # spam kontaktformular deny from 185.222.57.0/24 # wp-login deny from 192.99.0.0/16 # wp-login deny from 193.201.224.0/22 # wp-login deny from 209.59.228.0/22 # spam kontaktformular deny from 213.32.0.0/17 # wp-login deny from 2a03:b0c0::/48 # wp-login deny from 2a0c:ac00::/29 # wp-login # ---------------------------------------------------------------------- # | Zeichensatz setzen # ---------------------------------------------------------------------- AddDefaultCharset UTF-8 # ---------------------------------------------------------------------- # Wichtige WordPress-Dateien gegen den Zugriff von außen blocken # ---------------------------------------------------------------------- # Kein Zugriff auf die install.php Order allow,deny Deny from all # Kein Zugriff auf die wp-config.php Order allow,deny Deny from all # Kein Zugriff auf die readme.html Order Allow,Deny Deny from all Satisfy all # Kein Zugriff auf die liesmich.html für die DE Edition Order Allow,Deny Deny from all Satisfy all # Kein Zugriff auf das Error-Log Order allow,deny Deny from all #Zugriff auf .htaccess und .htpasswd verbieten. Wenn keine .htpasswd benutzt wird, kann der Code dafür entfernt werden. Order deny,allow Deny from all # Den Zugriff auf den Include-Ordner verbieten RewriteEngine On RewriteBase / RewriteRule ^wp-admin/includes/ - [F,L] RewriteRule !^wp-includes/ - [S=3] RewriteRule ^wp-includes/[^/]+\.php$ - [F,L] RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L] RewriteRule ^wp-includes/theme-compat/ - [F,L] # ---------------------------------------------------------------------- # Schutz des Administrator-Bereichs. Wenn der .htaccess/.htpasswd Schutz # genutzt werden soll, auskommentieren UND PFAD ANPASSEN # ---------------------------------------------------------------------- # #AuthName "Admin-Bereich" #AuthType Basic #AuthUserFile dein/pfad/zur/.htpasswd #require valid-user # #Full Path Disclosure abschalten - unterdrueckt die Anzeige des vollstaendigen Fehlerpfads #php_flag display_errors Off # ---------------------------------------------------------------------- # Hotlinking verbieten (verhindert, dass andere Deine Bilder von Deinem Server nutzen # WICHTIG: Auskommentieren und deine Domain einfuegen # ---------------------------------------------------------------------- RewriteEngine on RewriteCond %{HTTP_REFERER} !^$ RewriteCond %{HTTP_REFERER} !^https://(www.)?hanabi-pirna.de(/.*)?$ [NC] RewriteCond %{HTTP_REFERER} !^https://www.google..*$ [NC] RewriteCond %{HTTP_REFERER} !^https://www.bing..*$ [NC] RewriteCond %{HTTP_REFERER} !^https://www.facebook..*$ [NC] RewriteRule .(gif|jpg|GIF|JPG|png|PNG)$ - [F] # ---------------------------------------------------------------------- # Das Sicherheitsrisiko XML-RPC Schnittstelle komplett abschalten # ---------------------------------------------------------------------- Order Deny,Allow Deny from all # ---------------------------------------------------------------------- # Fehlerdokument # ---------------------------------------------------------------------- ErrorDocument 404 /seite-nicht-gefunden.html # ---------------------------------------------------------------------- # Startseite im Hochwasserfall - momentan deaktiviert - # ---------------------------------------------------------------------- # DirectoryIndex hochwasser.php # ---------------------------------------------------------------------- # | Umleitung von non-www auf www # ---------------------------------------------------------------------- RewriteEngine On RewriteCond %{HTTP_HOST} !^www\.hanabi-pirna\.de [NC] RewriteRule ^(.*) https://www.hanabi-pirna.de/$1 [R=301,L] # ---------------------------------------------------------------------- # | Umleitung https # ---------------------------------------------------------------------- RewriteEngine On RewriteCond %{SERVER_PORT} !=443 RewriteRule ^(.*)$ https://www.hanabi-pirna.de/$1 [R=301,L] # ---------------------------------------------------------------------- # | Umleitung index.html duplicate Content # ---------------------------------------------------------------------- RewriteEngine on RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /index\.html\ HTTP/ RewriteRule ^index\.html$ https://www.hanabi-pirna.de/ [R=301,L] # ---------------------------------------------------------------------- # | Seitenaufruf auch ohne .html - momentan deaktiviert # ---------------------------------------------------------------------- # RewriteEngine on # RewriteCond %{REQUEST_FILENAME} !-f # RewriteCond %{REQUEST_FILENAME} !-d # RewriteCond %{REQUEST_URI} !\.html$ [NC] # RewriteRule ^(.*)$ $1.html [L] # ---------------------------------------------------------------------- # | Seitenaufruf auch ohne Endung .php - momentan deaktiviert # ---------------------------------------------------------------------- # RewriteEngine on # RewriteCond %{REQUEST_FILENAME} !-f # RewriteCond %{REQUEST_FILENAME} !-d # RewriteCond %{REQUEST_URI} !\.php$ [NC] # RewriteRule ^(.*)$ $1.php [L] # ---------------------------------------------------------------------- # | Umleitung einzelner Dateien # ---------------------------------------------------------------------- Redirect permanent /jedermannsverzeichnis.html https://www.hanabi-pirna.de/aenderungsverlauf-von-dokumenten-zum-datenschutz.html # ---------------------------------------------------------------------- # Ende HTACCESS # ----------------------------------------------------------------------