Sécurité web

[.htaccess] Bloquer le trafic avec le référent "site.ru"

Langage du code ci-dessous : Apache

<IfModule mod_rewrite.c>
	RewriteCond %{HTTP_REFERER} site.ru [NC]
	RewriteCond %{HTTP_REFERER} site.ru
	RewriteRule .* – [F]
</IfModule>

Source : https://www.success.grownupgeek.com/index.php/2018/12/14/block-site-ru-referrers/

Permalien

[.htaccess] Empêcher l'accès à la liste des fichiers d'un répertoire

Langage du code ci-dessous : Apache

# Prevent directory browsing (don't list all files in a directory without a default document) 
# https://htaccessbook.com/what-is-options-all/
<IfModule mod_autoindex.c>
    Options All -Indexes
</IfModule>

Permalien

[.htaccess] En-têtes de sécurité

Langage du code ci-dessous : Apache

<IfModule mod_headers.c>

    # Disable automatic resource type detection
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
    Header always set X-Content-Type-Options "nosniff"

    # Block all content when an XSS attack is suspected
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
    Header always set X-XSS-Protection "1; mode=block"

    # Block frame rendering for the website - Prevent "clickjacking" attacks
    # SAMEORIGIN value to allow WordPress and plugins updates
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
    Header always set X-FRAME-OPTIONS "SAMEORIGIN"

    # The server should not be able to communicate in HTTP when it has an HTTPS connection - Prevent "man in the middle" attacks
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
    # Max age = 1 year
    # Read this doc before: https://blog.dareboost.com/fr/2017/09/hsts-fiabiliser-connexions-securisees/
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains;"

    # Security policy on the source of resources (CSP) - Prevent XSS attacks
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
    # This code is to customize. Here, no external resource and no inline style or script are allowed. Be careful by using this. Test it carefully!
    Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; base-uri 'self';"

</IfModule>

Permalien

[.htaccess] Redirection www et HTTPS

Langage du code ci-dessous : Apache

<IfModule mod_rewrite.c>
    # Redirect both to HTTPS and www.
    RewriteEngine On
    RewriteCond %{HTTPS} off [OR]
    RewriteCond %{HTTP_HOST} !^www\. [NC]
    RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
    RewriteRule ^.*$ https://www.%1%{REQUEST_URI} [L,NE,R=301]

    # Redirect to HTTPS only
    RewriteEngine on
    RewriteCond %{HTTPS} !=on
    RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</IfModule>

Source : https://www.webrankinfo.com/dossiers/techniques/redirection-http-https

Permalien