HTML, CGI, Java and Programming Tricks and Tips

After many frustrating months of learning how to protect my web site I decided to help some other webmasters out as well. There's really only one reason we need to worry about this stuff: People like to steal. Every increase in my site's security has been brought on by someone hacking into it and let me tell you, there have been many increases. :) I have separated this page into several sections: 1) Stopping hackers 2) Stopping site snagging (offline viewing) 3) Stopping Hotlinking 4) Multiple Domain Names: Shared Members Areas Section 1) Stopping hackers The most common way of protecting your members only area is with, as I'm sure you know, a filed named .htaccess sitting in your server's member's folder. This file is used by your server to pop up a little box and force people to enter a username and password. It then checks that against a password file located on your server to see it the info is valid. If it is, access is given. There are, however, many lines that you can add to your .htaccess file that most webmasters don't really know about. I'll go through them one by one as well as show you completed .htaccess files that you can start using immediately. NOTE: You only need to copy the text below that is in black. It is also important that you use a very basic text editor to save the file. Use Notepad or NoteTab to do it. DO NOT use MS Word! The file will not save correctly! You should also realize that an .htaccess file is just plain text file with a funny name. The complete file name really is .htaccess, period in front and all. Here is the basic .htaccess file that most people use:

AuthUserFile /server/path/to/your/password/file/.htpasswd AuthGroupFile /dev/null AuthName "Members Area" AuthType Basic <limit GET PUT POST> require valid-user </limit>

AuthUserFile /server/path/to/your/password/file/.htpasswd AuthGroupFile /dev/null AuthName "Members Area" AuthType Basic <limit GET PUT POST> require valid-user </limit> RewriteEngine On RewriteCond %{HTTP_REFERER} !^http://([a-z0-9-]+\.)*yourdomain.com/ [NC] RewriteRule /* http://www.yourdomain.com/login.htm [L,R]

<Limit GET> order allow,deny deny from 24.128.16.113 allow from all </Limit> errordocument 404 http://www.princessmandy.com/index.htm RewriteEngine On RewriteCond %{HTTP_USER_AGENT} ^.*WebZIP.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Stripper.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Offline.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Copier.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Crawler.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Snagger.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Teleport.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Reaper.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Wget.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Grabber.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Sucker.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Downloader.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Siphon.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Collector.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Mag-Net.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Widow.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Snake.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*BackWeb.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*gotit.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Vacuum.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Pump.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*HMView.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*HTTrack.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*JOC.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*likse.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Memo.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*pcBrowser.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*SuperBot.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*leech.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Mirror.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Recorder.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*GrabNet.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Likse.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Navroad.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*attach.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Magnet.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Surfbot.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Bandit.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Ants.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Buddy.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*Whacker.*$ [OR] RewriteCond %{HTTP_USER_AGENT} ^.*FileHound.*$ RewriteRule /* http://www.geocities.com/WestHollywood/Heights/3204/1home.html [L,R]

If you decide to redirect them somewhere else be sure to leave the "[L,R]" at the end of the line. It's rather important. Remember to always check your site immediately after uploading a new .htaccess file to your server. If there are any errors in you file, your site will most likely not load at all. In that case, quickly delete the file off of the server until you figure out what went wrong! 3) Stopping Hotlinking I think I see some of you smiling already. Yes, you can use an .htaccess file to stop people from hotlinking images off of your site. I recently discovered several of my pictures being posted on a messageboard. They had a little message and then my picture would pop up in the message. It was loading directly off of my server with absolutely nothing pointing back to me. I was pissed. The .htaccess file to prevent this is very similar to some of the ones above. It's just much shorter since it only performs one function, to stop hotlinking. It does this by checking the referrer. In other words, where the hit is coming from. I have actually moved all of my images, graphics, games, you name it into a subfolder in the free area. I then just place this .htaccess file into that folder. I DON"T recommend adding these lines into the .htaccess file above that protects your entire site. Why? Well, when you sign up on someone else's friends page you have to enter in a URL of your ID picture. If you block everything than all of your ID pictures on all of those friends pages you signed up for will not load. Your ID picture will be a very sexy little red x. You can stop people from hotlinking your id pictures if you want, just think it through first. I have my banner farm protected to stop new sign ups from hotlinking. However, I still have a few I pictures in unprotected areas too. That way I can sign up for new friends and links pages. You also don't want to block everything if you purposely post pictures at picpost pages. If you block your entire site, none of those picposts will load. Similar to some of the above files, this one will allow the picture to load if the referring site starts with princessmandy.com/ only. Do not include the www. in here. That's what all of the crap in front of princessmandy.com/ is for. The referrer can end with anything it likes, as long as it has princessmandy.com/ in it.

RewriteEngine On RewriteCond %{HTTP_REFERER} !^http://([a-z0-9-]+\.)*princessmandy.com/ [NC] RewriteRule /* http://www.princessmandy.com [L,R]

Multiple Domain Names: Shared Members Areas Here's a fun one. Many of you may have several web sites but only one credit card account and one password file. How do you get everyone to have access to all of your site's members areas but only use one account? Easy. Use .htaccess files. This can get a little bit tricky so pay attention. Let's say you have three sites: monkeyone.com, monkeytwo.com, and monkeythree.com Let's also say that you want anyone joining one site to have access to all three. Pick one site to house the main entry page. Just like in the above examples, create a page called http://www.monkeyone.com/login.htm in the free area of that site. You can call it whatever you want. Use that page as the entry page for all of your web sites. Just put a link on there saying "click here to enter the member's area" or something. Now everywhere on monkeytwo.com and monkeythree.com that says "member's entrance" should point to http://www.monkeyone.com/login.htm. Understand? Only one entrance page and only one password file. Everyone must enter from the same place. Now, you'll need to add the following lines to your .htaccess file in the member's only folder of monkeyone.com. RewriteEngine On RewriteCond %{HTTP_REFERER} !^http://([a-z0-9-]+\.)*monkeyone.com/ [NC] RewriteCond %{HTTP_REFERER} !^http://([a-z0-9-]+\.)*monkeytwo.com/members/ [NC] RewriteCond %{HTTP_REFERER} !^http://([a-z0-9-]+\.)*monkeythree.com/members/ [NC] RewriteRule /* http://www.monkeyone.com/login.htm [L,R] This will allow entry only from either your main page's entry page, or from the member's area of your other sites. Is part is tricky to think about but very important. Your new monkeyone.com member's only folder .htaccess file will most likely look like this:

AuthUserFile /server/path/to/your/password/file/.htpasswd AuthGroupFile /dev/null AuthName "Members Area" AuthType Basic <limit GET PUT POST> require valid-user </limit> RewriteCond %{HTTP_REFERER} !^http://([a-z0-9-]+\.)*monkeyone.com/ [NC] RewriteCond %{HTTP_REFERER} !^http://([a-z0-9-]+\.)*monkeytwo.com/members/ [NC] RewriteCond %{HTTP_REFERER} !^http://([a-z0-9-]+\.)*monkeythree.com/members/ [NC] RewriteRule /* http://www.monkeyone.com/login.htm [L,R]

RewriteCond %{HTTP_REFERER} !^http://([a-z0-9-]+\.)*monkeyone.com/members/ [NC] RewriteCond %{HTTP_REFERER} !^http://([a-z0-9-]+\.)*monkeytwo.com/members/ [NC] RewriteCond %{HTTP_REFERER} !^http://([a-z0-9-]+\.)*monkeythree.com/members/ [NC] RewriteRule /* http://www.monkeyone.com/login.htm [L,R]