Secure your .htaccess files

Written by James McDonald

May 26, 2010

Recently discovered an old Joomla website that had been hacked by a remote exploit which changed the contents of .htaccess and redirected the connecting clients away to malicious sites.

I don’t know how they managed it but I thought that if .htaccess wasn’t writeable by the webserver process then the hack would have failed to modify .htaccess and therefore the problem would be reduced.

So to find your .htaccess files:

# run this from the highest directory possible so you find all your web .htaccess files
 find ./ -name .htaccess | xargs -I {} ls -al {}

To remove write access for user group and world:

 find ./ -name .htaccess | xargs -I {}  chmod  -w {}

0 Comments

Submit a Comment

Your email address will not be published. Required fields are marked *

You May Also Like…

How to Research a CPU Upgrade

How to Research a CPU Upgrade

Upgrade Time! Doing a lot of VMWare Workstation virtualization to create labs for self-study and training. Finding...