Protecting admin.php, the /install directory, and test & development installations using .htaccess

[sifuhall]

Not sure if this works on all systems, but for me the first line:

<Files admin.php>

Should be:

<FilesMatch admin.php>

 

[Jaxel]

This still doesn't work for me...

<Files admin.php>
AuthType Basic
AuthName "8wayRun Administration"
AuthUserFile "*********"
Require valid-user
</Files>

I get the following error: A controller for the route path admin.php was not found.

 

[EasyTarget]

This still doesn't work for me...

AuthName "8wayRun Administration"

You have a space in the AuthName, I think only alphanumeric characters are allowed?

 

[Cool]

you could eaven mix it as:
Allow from IP without password prompt, and also allow from any address with password prompt

<Files admin.php>
Order deny,allow
Deny from all
AuthName "htaccess password prompt"
AuthUserFile /your/path/.htpasswd
AuthType Basic
Require valid-user
Allow from 172.17.10.1
Satisfy Any
</Files>

 

[Martyn]

This still doesn't work for me...

<Files admin.php>
AuthType Basic
AuthName "8wayRun Administration"
AuthUserFile "*********"
Require valid-user
</Files>

I get the following error: A controller for the route path admin.php was not found.

try this one

http://xenforo.com/community/thread...l-directory-using-htaccess.13768/#post-180975

 

[Jaxel]

try this one

http://xenforo.com/community/thread...l-directory-using-htaccess.13768/#post-180975

Thats for ip protect, not password protect.

 

[Martyn]

Thats for ip protect, not password protect.

ip protection is safer then password! no bruteforce attacks and looks nicer? rather then saying password incorrect, you send them to a different area aswell so if someone on the forum members goes to admin.php it just sends them back to index.php etc etc?

 

[DRE]

Thanks!

 

[mrGTB]

Do it the easy way. http://tools.dynamicdrive.com/password/

 

[MattW]

I always add this to the end of my htaccess to bounce them back to the main page, rather than showing them an error message:

ErrorDocument 404 http://www.z22se.co.uk/
ErrorDocument 403 http://www.z22se.co.uk/

 

[indicator]

@Brogan How do we do for protecting install. is it like following?
<Files /install>
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
</Files>

i tried this but didn't work

 

[Paul B]

Don't use the files tags.

Order Deny,Allow
Deny from all
Allow from 127.0.0.1

 

[indicator]

Don't use the files tags.

Order Deny,Allow
Deny from all
Allow from 127.0.0.1

i tired that one too but then i was blocking the whole website from other IP

 

[Paul B]

Make sure you are only adding it to the .htaccess file in the /install directory.

 

[indicator]

Got it now, Thanks Brogan for your assistance, i din't create separate .htaccess in install directory. now all working fine

 

[Divvens]

Got it now, Thanks Brogan for your assistance, i din't create separate .htaccess in install directory. now all working fine

Also remember to remove the file while going to update xenForo (in the case of you getting any 403 Forbidden permission error)!

I had totally forgotten that I had the protection in place and was wondering what was wrong for quite a bit a couple of months back, before I figured out the file was in place. So you'll need to remove the file from the directory, and then re-up it after your update is done!

 

[Paul B]

Why did you have to remove it?

Mine has been in place for multiple upgrades with no problems.

 

[Divvens]

Why did you have to remove it?

Mine has been in place for multiple upgrades with no problems.

After the files have been uploaded, when it tells you to go to the install directory to finish the upgrade and if the htaccess file is still there it'll give you a 403 permission error. Sorry, maybe I should have made it more clear that I was speaking about the install directory only!

I also have a dynamic IP, thus requiring me to remove it and re-upload the file.

 

[Paul B]

Ah.

I actually use the file method as I too have a dynamic IP address (and I switch my router off every night).

 

[xIsabel38]

For several other forums, you are actually told to delete the install directory, is that not an option here?