HTACCESS

• This feature is only available for Professional hosting accounts.
• This feature is recommended for users of intermediate to advanced levels

What Is It?

.htaccess is a plain text file used to customize some web server settings for your website. It applies a set of configuration options to all files in the directory that the file is located. In addition, these options will also apply to subdirectories of that directory, unless a separate .htaccess file in those directories contains different settings.

Cautions

It is important to follow these guidelines when editing .htaccess files:

• The filename must be exactly .htaccess - you can not use any other filename.
  • If you have problems renaming a file to .htaccess in windows, open the file in Notepad, Choose "Save as.." and select "All types (*.*)" next to file type. Now type the filename ".htaccess" and click save.

• Any rules you set with an .htaccess file will apply to all files in the directory you have placed the .htaccess file, and any of its subdirectories. The .htaccess rules in the current directory will override any .htaccess rules set in a parent directory.

• Any typos or mistakes in a .htaccess file will may result in an HTTP 500 server error being returned when you try to visit that directory, and may render your entire site offline. If this happens, you can still access your site with the File Manager on your Bravenet.com website manager, or with any FTP program.

• .htaccess files are very picky about what you put in them so please be careful to use exact syntax.

• Do not attempt to turn PHP safe mode off in a .htaccess file - this will not work and will cause your site to stop working until you undo the change.

Other Questions

I can't see the .htaccess file in my FTP program. Any file that starts with a '.' is considered a hidden file on Unix systems. Some FTP programs will not show these 'dot files' by default. Here's some instructions on how to enable hidden files for some of the more popular FTP programs:

• FileZilla

1. View -> Show hidden files.

• Cute FTP

1. Open the Site Manager (press F4) and click on the name of the relevant site.
2. Click the Actions tab, then click Filter.
3. Select the Enable Filtering check box.
4. In Server side filtering, select the Enable Server Side Filtering check box.
5. In the Remote Filter box, type -a.
6. Click OK, then click Connect.

• WS_FTP Pro (7.62)

1. Sites
2. Organize sites
3. Site options
4. Startup tab
5. In Remote Filter Mask box enter -a

Remember, you can always use the File Manager on our web site manager page to easily upload, download, or even edit your .htaccess files.

Using htaccess To...

Add a password to your site

To protect your full folder, you will need two files:

1. The .htaccess file - this is placed inside the folder you want to protect
2. The .htpasswd file - this should be placed in a folder on your site where only you have access to edit it

The server path you need to add to the beginning of your AuthUserFile path is located within your Bravenet account. The AuthUserFile path should point to your password file. To get the path, login to your Bravenet.com account, click on Websites, click on your URL, and then scroll down to the Storage Path. In this example, the storage path is /misc/12/345/678/901/2/user/web/securearea.mysite.org/

You would add the following to your .htaccess file:

AuthUserFile /misc/12/345/678/901/2/user/web/securearea.mysite.org/.htpasswd
AuthName "Private Area"
AuthType Basic
require valid-user

Your .htpasswd file would look something like this:

bravenet:B3nlQW12jcynE
admin:cGyUX9QugYMgE

The passwords stored in the .htpasswd file are encrypted - if you want admin's password to be password, you would first have to run password through a password generator, such as you can find here, getting cGyUX9QugYMgE. This would be be the password you would place in the .htpasswd file. Now, when visiting securearea.mysite.org, you would be prompted for a username and password. admin with the password of password would give you access to the site.

Block another website from linking to yours

Add the following to a .htaccess file in the directory containing the files you want to protect, and change the text "badsite.com" to be the exact name of the website you want to block:

# go away!
RewriteEngine On
RewriteCond %{HTTP_REFERER} ^http://badsite.com(.*)$ [NC] RewriteRule ^.* - [F,L]

Use custom error pages

If you would like to have custom error pages, you can add the following to your .htaccess file:

ErrorDocument 404 404.php
ErrorDocument 403 403.php
ErrorDocument 500 500.php
ErrorDocument 401 401.php

Now if someone visits, for example, www.yoursite.com/this_page_does_not_exist they will get served 404.php as an error page instead of the default 404_not_found.html page.

Enable or disable error reporting in PHP

Add the following lines to your .htaccess file to enable error reporting:

Options +FollowSymlinks
RewriteEngine on
php_flag display_errors on
php_value error_reporting 7

We have display_errors set to "on" by default for all users - this is to help inform you of problems when you are working on your site. You may want to turn that off when you are ready to show your site off to the world - use the following to disable errors:

php_value display_errors 0

When errors are disabled, the visitor will only see a blank page when an error is encountered, instead of several lines of PHP code and error messages.

Enable the "Register Globals" PHP flag

Add the following only if your PHP code specifically requires this setting. It does have some security implications, so you should only use it if you need to. In addition, this setting will no longer be an option once PHP 6.0 is released, so please consider staying clear of PHP code that requires this setting.

php_value register_globals 1

Limiting access to your website based by IP address

Add the following to a .htaccess file in the directory you want to protected:

# allow access to just two ips
Order Allow,Deny
# my home ip, my work ip
allow from 168.55.55.11 58.66.12.79

Be careful as you may lock yourself out of your own site. If this happens, you can always access your site with a ftp program or with our File Manager tool and remove or modify the .htaccess file. People who are blocked from your site will be shown the 403 error page (by default 403_forbidden.html)

Similarly, to block people from specific ip addresses from accessing your site, you could add the following to your .htaccess file:

# Block all access from 192.168.10.5
Order Deny,Allow
Deny from 192.168.10.5

Hide .php extensions to make your website address look cleaner

If you want to hide .php extensions to make your site appear more "clean" you can add the following to a .htaccess file:

Options +MultiViews

Now, for example, instead of seeing http://yoursite.com/dem.php?forum=1 you would see http://yoursite.com/dem?forum=1. Be careful with this though, as it can lead to unexpected results. As always, test your changes thoroughly!

Add a MIME type to the webserver

Adding a MIME type to the server allows visitors to your website to be prompted to open files directly into the correct application. For example, if you have some java programs on your website, and want visitors to be able to run those programs directly in Java webstart, you would add the following to your .htaccess file:

AddType application/x-java-jnlp-file JNLP

Enable compression for PHP files

Bravenet use compression on certain files to make downloading websites a lot faster. However, some files we leave uncompressed to avoid certain errors. If you would like to enable compression on everything, add the following to your .htaccess file. Make sure to test your entire site if you enable this option - some code does not like this setting.

# enable compression for everything 
SetOutputFilter DEFLATE

Resources

[1]

• This website has an excellent .htaccess generator, and more information about .htaccess files.

[2]

• Another tool to create .htaccess files

[3]

• Apache's rewrite guide has more information on using rewrite rules.