Post Pic

Protect your WordPress blog using .htaccess

The .htaccess file have lots of possibilities. Today, let’s see how we can protect our WordPress blog from scripts injection, and unwanted modification of _REQUEST and/or GLOBALS.

Simply paste the following lines into your .htaccess file. This file is located at the root of your WordPress install.
Remember to always make a backup of your .htaccess file before editing it so, you'll be able to restore it if something went wrong.

Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]

Thanks to Oussama for those simple, but efficient lines of code!

One Response

May 14 2012 20:29

I have an existing htaccess file. I assume the first two lines can be omitted. Is this correct?

Also, just how common and/or dangerous are these hacks? Are these “unwanted modification of _REQUEST and/or GLOBALS” hacks something specialized that affect existing content, or only when content is being modified?

Trackbacks:

Leave a Comment

* Name, Email, Comment are Required

WP Theme of the week

Sponsored Likebox