diff --git a/.htaccess b/.htaccess index 0682fc8..216f0ca 100644 --- a/.htaccess +++ b/.htaccess @@ -9,24 +9,22 @@ RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L] -# HTTPS for authentication pages -SSLOptions +StrictRequire -SSLRequireSSL -SSLRequire %{HTTP_HOST} eq "%{HTTP_HOST}%{REQUEST_URI}" -ErrorDocument 403 https://%{HTTP_HOST}%{REQUEST_URI} - # Hackerbots Prevention RewriteEngine on RewriteCond %{HTTP_USER_AGENT} ^ZmEu [OR] RewriteCond %{HTTP_USER_AGENT} (.*)Msqq(.*) RewriteRule .* http://www.urbandictionary.com/define.php?term=fuck+you [R=301,L] -# Prevent public access to the logs +# Prevent public access to the logs, requires login through HTTPS -AuthType Basic -AuthName "Restricted Area" -AuthUserFile /var/www/passes/imeji/.htpasswd -Require valid-user + SSLOptions +StrictRequire + SSLRequireSSL + SSLRequire %{HTTP_HOST} eq "%{HTTP_HOST}%{REQUEST_URI}" + ErrorDocument 403 https://%{HTTP_HOST}%{REQUEST_URI} + AuthType Basic + AuthName "Restricted Area" + AuthUserFile /var/www/passes/imeji/.htpasswd + Require valid-user # Allow linking asset elemets across subdomains