Protecting admin.php, the /install directory, and test & development installations using .htaccess

[Paul B]

No, it's not necessary with XenForo.

 

[xIsabel38]

Okay, always wondered that. Thanks.

 

[zoldos]

Why are we keeping the install folder intact? Just delete it. lol

 

[Paul B]

It is required for certain operations.

 

[zoldos]

I'm under the impression it needs to be deleted right away except for upgrading your forum...

 

[Amaury]

I'm under the impression it needs to be deleted right away except for upgrading your forum...

On vBulletin, but not on XenForo.

 

[Paul B]

I'm under the impression it needs to be deleted right away except for upgrading your forum...

That is incorrect.

 

[zoldos]

That is incorrect.

I deleted my install folder and everything works great, XF 1.4.6....

 

[Paul B]

It is required for certain operations.

 

[zoldos]

Okay cool.

 

[rafass]

I deleted my install folder and everything works great, XF 1.4.6....

Run File Health Check. ACP -> Tools -> File Health Check

/
Great tips, all protected now, Thanks Brogan!

 

[Vet]

When I try to password protect the directory, it now requires a pass for public access to the entire forum. How do I protect only for admin?

#    Mod_security can interfere with uploading of content such as attachments. If you
#    cannot attach files, remove the "#" from the lines below.
#<IfModule mod_security.c>
#    SecFilterEngine Off
#    SecFilterScanPOST Off
#</IfModule>

ErrorDocument 401 default
ErrorDocument 403 default
ErrorDocument 404 default
ErrorDocument 405 default
ErrorDocument 406 default
ErrorDocument 500 default
ErrorDocument 501 default
ErrorDocument 503 default

<IfModule mod_rewrite.c>
    RewriteEngine On

    #    If you are having problems with the rewrite rules, remove the "#" from the
    #    line that begins "RewriteBase" below. You will also have to change the path
    #    of the rewrite to reflect the path to your XenForo installation.
    #RewriteBase /xenforo

    #    This line may be needed to enable WebDAV editing with PHP as a CGI.
    #RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    RewriteCond %{REQUEST_FILENAME} -f [OR]
    RewriteCond %{REQUEST_FILENAME} -l [OR]
    RewriteCond %{REQUEST_FILENAME} -d
    RewriteRule ^.*$ - [NC,L]
    RewriteRule ^(data/|js/|styles/|install/|favicon\.ico|crossdomain\.xml|robots\.txt) - [NC,L]
    RewriteRule ^.*$ index.php [NC,L]
</IfModule>
AuthName "ACP"
<Files admin.php>
AuthName "ACP"
AuthUserFile "/home/***redacted***/.htpasswds/public_html/forum/passwd"
</Files>

 

[Mike]

Double check the code in the resource vs the code you added. It's not the same (notably, you added a line outside the <Files> block.

 

[Vet]

Double check the code in the resource vs the code you added. It's not the same (notably, you added a line outside the <Files> block.

Talk about a blaring oversight. Issue resolved. Thanks again for taking the time to help me out on this.

 

[kibi]

You told for cPanel : "A passwd file will be created in /.htpasswds/public_html/<name_of_your_forum_root_folder>"
Where is find such file for Plesk ?

 

[Martok]

Here's a guide to doing so in Plesk 12.

Customer's Guide, Plesk 12.0

Personally I prefer to create the passwd file myself using this Htpasswd Generator – Create htpasswd - Htaccess Tools and uploading it via ftp.

 

[kibi]

Thanks for hint Martok!
You are right - Htpasswd Generator is better!
By the way, how to add the following code with IP protection for admin.php?
So we have psw protection + IP filter for file admin.php also

<Files "admin.php">
AuthType Basic
AuthName "ACP"
AuthUserFile "/path_to_folder/.htpasswd"
Require valid-user
Order Deny,Allow
Deny from all
Allow from localhost
Allow from 127.0.0.1
Allow from x.x.x.x
Allow from x2.x2.x2.x2
Allow from x3.x3.x3.x3
</Files>

 

[Bob_R]

Let's see if I have this correct for IP protection.

This is added to the already existing .htaccess in the root. Add this where in the root? Beginning, end? Does it matter?

<Files admin.php>
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
</Files>

And for install create a .htaccess

Order Deny,Allow
Deny from all
Allow from 127.0.0.1

Of course replace 127.0.0.1 with your own IP.

Did I say this correctly?

 

[Paul B]

It doesn't really matter, just add it to the top of the file.

 

[PASS]

What do I do if the forum is installed in the root directly? Ex: public_html