--- title: 'Файлы .htaccess: универсальные настройки для популярных CMS | Zomro' description: 'Файл .htaccess (сокращение от Hypertext Access) — это конфигурационный файл, который используется на серверах Apache' image: 'https://dx86q6oq7ry0e.cloudfront.net/uploads/blog/a48%40server-panel.net/2025/02/28/dalle-2025-02-28-203401-a-futuristic-and-sleek-rectangular-illustration-representing-htaccess-file-configurations-for-popular-cms-the-design-features-a-glowing-code-snippet_q50.jpg' --- ![opened image]() * [Zomro](https://zomro.com/rus/) * [FAQ](https://zomro.com/rus/blog/faq/) * Файлы .htaccess: универсальные настройки для популярных CMS # Файлы .htaccess: универсальные настройки для популярных CMS 28-02-2025 ![](https://dx86q6oq7ry0e.cloudfront.net/uploads/blog/a48%40server-panel.net/2025/02/28/dalle-2025-02-28-203401-a-futuristic-and-sleek-rectangular-illustration-representing-htaccess-file-configurations-for-popular-cms-the-design-features-a-glowing-code-snippet_q50.jpg) # **Файлы .htaccess: универсальные настройки для популярных CMS** Файл **.htaccess** (сокращение от _Hypertext Access_) — это конфигурационный файл, который используется на серверах Apache (или совместимых с ним). Он позволяет локально влиять на работу веб-сервера в выбранной папке и её поддиректориях, не затрагивая при этом общий конфигурационный файл. Благодаря .htaccess можно гибко настраивать различные аспекты сайта: от перенаправлений и защиты доступа до оптимизации загрузки и управления ошибками. ![](https://dx86q6oq7ry0e.cloudfront.net/uploads/blog/a48%40server-panel.net/2025/02/28/dalle-2025-02-28-203655-a-futuristic-and-sleek-rectangular-illustration-highlighting-key-features-of-htaccess-the-design-features-a-glowing-document-icon-labeled-htaccess_q50.jpg) ## ## **Ключевые возможности .htaccess** **Перенаправления (редиректы)** С помощью .htaccess можно перенаправлять запросы с одного URL на другой. Самый распространённый пример — постоянное (301) перенаправление, указывающее поисковым системам, что страница переехала навсегда. apache Redirect 301 /old-page http://example.com/new-page **Ограничение и настройка доступа** 1. Файл .htaccess позволяет запретить доступ к отдельным каталогам или файлам, настроить базовую авторизацию или фильтровать IP-адреса. Это помогает защитить конфиденциальные данные и ограничить доступ к административной части сайта. 2. **Настройка «человекопонятных» URL** Модуль mod_rewrite даёт возможность упростить адреса страниц, сделав их удобными для пользователей и SEO. Например, вместо http://example.com/?page=12 настроить http://example.com/about. 3. **Кэширование** Для увеличения скорости загрузки можно указать браузеру, на какой срок кэшировать статические ресурсы (картинки, стили, скрипты и т.д.). Это ускоряет работу сайта и разгружает сервер. 4. **Управление ошибками** Если посетитель попал на несуществующую страницу, можно настроить дружелюбную 404-страницу. Аналогично задаются страницы ошибок 500, 403 и других, что делает сайт более удобным. 5. **Изменение и добавление HTTP-заголовков** С помощью специальных директив в .htaccess можно настраивать заголовки для повышения безопасности (например, Content-Security-Policy) или улучшения кэширования. ## ## ![](https://dx86q6oq7ry0e.cloudfront.net/uploads/blog/a48%40server-panel.net/2025/02/28/dalle-2025-02-28-203805-a-futuristic-and-sleek-rectangular-illustration-representing-a-minimal-htaccess-configuration-the-design-features-a-glowing-code-snippet-of-a-basic_q50.jpg) ## **Пример минимальной конфигурации** Ниже приводится один из самых простых примеров .htaccess, где настроено постоянное перенаправление старой страницы на новую: Redirect 301 /old-page http://example.com/new-page Такая инструкция говорит серверу, что любой запрос к /old-page следует перенаправлять на http://example.com/new-page. Это удобно при изменении структуры сайта или переименовании страниц. ## ## **Важные моменты при работе с .htaccess** 1. **Производительность** Каждый раз, когда сервер обрабатывает запрос, он проверяет файлы .htaccess в соответствующих папках. Если таких файлов много или они содержат сложные правила, это может повлиять на скорость работы сайта. 2. **Совместимость с сервером** Не все веб-серверы поддерживают .htaccess. Например, Nginx использует иной подход к настройке. Если ваш хостинг работает на Apache — тогда проблем не будет. 3. **Влияние на весь сайт** Изменения в .htaccess затрагивают все поддиректории текущего каталога, поэтому любая ошибка может сломать работу значительной части сайта. При редактировании обязательно делайте резервные копии. 4. **Мощный, но требует аккуратности** .htaccess даёт широкие возможности, однако важно понимать, как работают модули mod_rewrite, mod_expires и другие. Неосторожные изменения могут привести к сбоям или ошибкам доступа. **Стандартные файлы .htaccess для популярных CMS** У каждой CMS (WordPress, Joomla, Drupal и т.д.) есть свой рекомендованный файл .htaccess, который обычно лежит в корневой папке сайта. В нём содержатся типовые правила для: * Создания ЧПУ (человекопонятных URL). * Защиты административных директорий. * Кэширования и сжатия статических ресурсов. * Правильного перенаправления при использовании SSL-сертификата. ![](https://dx86q6oq7ry0e.cloudfront.net/uploads/blog/a48%40server-panel.net/2025/02/28/dalle-2025-02-28-203910-a-futuristic-and-sleek-rectangular-illustration-representing-standard-htaccess-files-for-popular-cms-the-design-features-a-glowing-folder-labeled_q50.jpg) Чтобы сайт работал корректно, важно либо использовать стандартный вариант .**htaccess** от разработчиков CMS, либо вносить в него изменения очень осторожно. Ниже приведены конкретные примеры **.htaccess-** файлов для наиболее популярных платформ. ### **.htaccess для DLE** DirectoryIndex index.php RewriteEngine On RewriteBase / # Редиректы RewriteRule ^page/(.*)$ index.php?cstart=$1 [L] # Сам пост RewriteRule ^([0-9]{4})/([0-9]{2})/([0-9]{2})/page,([0-9]+),([0-9]+),(.*).html(/?)+$ index.php?subaction=showfull&year=$1&month=$2&day=$3&news_page=$4&cstart=$5&news_name=$6 [L] RewriteRule ^([0-9]{4})/([0-9]{2})/([0-9]{2})/page,([0-9]+),(.*).html(/?)+$ index.php?subaction=showfull&year=$1&month=$2&day=$3&news_page=$4&news_name=$5 [L] RewriteRule ^([0-9]{4})/([0-9]{2})/([0-9]{2})/print:page,([0-9]+),(.*).html(/?)+$ engine/print.php?subaction=showfull&year=$1&month=$2&day=$3&news_page=$4&news_name=$5 [L] RewriteRule ^([0-9]{4})/([0-9]{2})/([0-9]{2})/(.*).html(/?)+$ index.php?subaction=showfull&year=$1&month=$2&day=$3&news_name=$4 [L] RewriteRule ^([^.]+)/page,([0-9]+),([0-9]+),([0-9]+)-(.*).html(/?)+$ index.php?newsid=$4&news_page=$2&cstart=$3&seourl=$5&seocat=$1 [L] RewriteRule ^([^.]+)/page,([0-9]+),([0-9]+)-(.*).html(/?)+$ index.php?newsid=$3&news_page=$2&seourl=$4&seocat=$1 [L] RewriteRule ^([^.]+)/print:page,([0-9]+),([0-9]+)-(.*).html(/?)+$ engine/print.php?news_page=$2&newsid=$3&seourl=$4&seocat=$1 [L] RewriteRule ^([^.]+)/([0-9]+)-(.*).html(/?)+$ index.php?newsid=$2&seourl=$3&seocat=$1 [L] RewriteRule ^page,([0-9]+),([0-9]+),([0-9]+)-(.*).html(/?)+$ index.php?newsid=$3&news_page=$1&cstart=$2&seourl=$4 [L] RewriteRule ^page,([0-9]+),([0-9]+)-(.*).html(/?)+$ index.php?newsid=$2&news_page=$1&seourl=$3 [L] RewriteRule ^print:page,([0-9]+),([0-9]+)-(.*).html(/?)+$ engine/print.php?news_page=$1&newsid=$2&seourl=$3 [L] RewriteRule ^([0-9]+)-(.*).html(/?)+$ index.php?newsid=$1&seourl=$2 [L] # За день RewriteRule ^([0-9]{4})/([0-9]{2})/([0-9]{2})(/?)+$ index.php?year=$1&month=$2&day=$3 [L] RewriteRule ^([0-9]{4})/([0-9]{2})/([0-9]{2})/page/([0-9]+)(/?)+$ index.php?year=$1&month=$2&day=$3&cstart=$4 [L] # За весь месяц RewriteRule ^([0-9]{4})/([0-9]{2})(/?)+$ index.php?year=$1&month=$2 [L] RewriteRule ^([0-9]{4})/([0-9]{2})/page/([0-9]+)(/?)+$ index.php?year=$1&month=$2&cstart=$3 [L] # Вывод за весь год RewriteRule ^([0-9]{4})(/?)+$ index.php?year=$1 [L] RewriteRule ^([0-9]{4})/page/([0-9]+)(/?)+$ index.php?year=$1&cstart=$2 [L] # вывод отдельному тегу RewriteRule ^tags/([^/]*)(/?)+$ index.php?do=tags&tag=$1 [L] RewriteRule ^tags/([^/]*)/page/([0-9]+)(/?)+$ index.php?do=tags&tag=$1&cstart=$2 [L] # вывод для отдельного юзера RewriteRule ^user/([^/]*)/rss.xml$ engine/rss.php?subaction=allnews&user=$1 [L] RewriteRule ^user/([^/]*)(/?)+$ index.php?subaction=userinfo&user=$1 [L] RewriteRule ^user/([^/]*)/page/([0-9]+)(/?)+$ index.php?subaction=userinfo&user=$1&cstart=$2 [L] RewriteRule ^user/([^/]*)/news(/?)+$ index.php?subaction=allnews&user=$1 [L] RewriteRule ^user/([^/]*)/news/page/([0-9]+)(/?)+$ index.php?subaction=allnews&user=$1&cstart=$2 [L] RewriteRule ^user/([^/]*)/news/rss.xml(/?)+$ engine/rss.php?subaction=allnews&user=$1 [L] # вывод всех последних новостей RewriteRule ^lastnews/(/?)+$ index.php?do=lastnews [L] RewriteRule ^lastnews/page/([0-9]+)(/?)+$ index.php?do=lastnews&cstart=$1 [L] # вывод в виде каталога RewriteRule ^catalog/([^/]*)/rss.xml$ engine/rss.php?catalog=$1 [L] RewriteRule ^catalog/([^/]*)(/?)+$ index.php?catalog=$1 [L] RewriteRule ^catalog/([^/]*)/page/([0-9]+)(/?)+$ index.php?catalog=$1&cstart=$2 [L] # вывод непрочитанных статей RewriteRule ^newposts(/?)+$ index.php?subaction=newposts [L] RewriteRule ^newposts/page/([0-9]+)(/?)+$ index.php?subaction=newposts&cstart=$1 [L] RewriteRule ^favorites(/?)+$ index.php?do=favorites [L] RewriteRule ^favorites/page/([0-9]+)(/?)+$ index.php?do=favorites&cstart=$1 [L] RewriteRule ^rules.html$ index.php?do=rules [L] RewriteRule ^statistics.html$ index.php?do=stats [L] RewriteRule ^addnews.html$ index.php?do=addnews [L] RewriteRule ^rss.xml$ engine/rss.php [L] RewriteRule ^sitemap.xml$ uploads/sitemap.xml [L] RewriteCond %{REQUEST_FILENAME} !-d RewriteRule ^([^.]+)/page/([0-9]+)/$ index.php?do=cat&category=$1&cstart=$2 [L] RewriteRule ^([^.]+)/$ index.php?do=cat&category=$1 [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^([^.]+)/rss.xml$ engine/rss.php?do=cat&category=$1 [L] RewriteRule ^page,([0-9]+),([^/]+).html$ index.php?do=static&page=$2&news_page=$1 [L] RewriteRule ^print:([^/]+).html$ engine/print.php?do=static&page=$1 [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^([^/]+).html$ index.php?do=static&page=$1 [L] **.htaccess для Wordpress** # BEGIN WordPress RewriteEngine On RewriteBase / RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L] # END WordPress ### **.htaccess для HostCMS** Options +FollowSymlinks AddDefaultCharset Off php_flag magic_quotes_gpc off php_flag magic_quotes_runtime off php_flag register_globals off php_flag magic_quotes_gpc off php_flag magic_quotes_runtime off php_flag register_globals off DirectoryIndex index.php index.htm index.html RewriteEngine On RewriteBase / RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule ^(.*)$ /index.php ### **.htaccess для Bitrix** ErrorDocument 404 /404.php php_flag allow_call_time_pass_reference 1 php_flag session.use_trans_sid off #php_value display_errors 1 #php_value mbstring.func_overload 2 #php_value mbstring.internal_encoding UTF-8 Options +FollowSymLinks RewriteEngine On RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-l RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_FILENAME} !/bitrix/urlrewrite.php$ RewriteRule ^(.*)$ /bitrix/urlrewrite.php [L] RewriteRule .* - [E=REMOTE_USER:%{HTTP:Authorization}] DirectoryIndex index.php index.html ExpiresActive on ExpiresByType image/jpeg "access plus 3 day" ExpiresByType image/gif "access plus 3 day" **.htaccess для Modx** # MODx supports Friendly URLs via this .htaccess file. You must serve web # pages via Apache with mod_rewrite to use this functionality, and you must # change the file name from ht.access to .htaccess. # Make sure RewriteBase points to the directory where you installed MODx. # E.g., "/modx" if your installation is in a "modx" subdirectory. # You may choose to make your URLs non-case-sensitive by adding a NC directive # to your rule: RewriteRule ^(.*)$ index.php?q=$1 [L,QSA,NC] RewriteEngine On RewriteBase / # Rewrite www.domain.com -> domain.com -- used with SEO Strict URLs plugin #RewriteCond %{HTTP_HOST} . #RewriteCond %{HTTP_HOST} !^example-domain-please-change\.com [NC] #RewriteRule (.*) http://example-domain-please-change.com/$1 [R=301,L] # or for the opposite domain.com -> www.domain.com use the following # DO NOT USE BOTH #RewriteCond %{HTTP_HOST} . #RewriteCond %{HTTP_HOST} !^www\.example-domain-please-change\.com [NC] #RewriteRule (.*) http://www.example-domain-please-change.com/$1 [R=301,L] # Rewrite secure requests properly to prevent SSL cert warnings, e.g. prevent # https://www.domain.com when your cert only allows https://secure.domain.com #RewriteCond %{SERVER_PORT} !^443 #RewriteRule (.*) https://example-domain-please-change.com.com/$1 [R=301,L] # The Friendly URLs part RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule ^(.*)$ index.php?q=$1 [L,QSA] # Make sure .htc files are served with the proper MIME type, which is critical # for XP SP2. Un-comment if your host allows htaccess MIME type overrides. #AddType text/x-component .htc # If your server is not already configured as such, the following directive # should be uncommented in order to set PHP's register_globals option to OFF. # This closes a major security hole that is abused by most XSS (cross-site # scripting) attacks. For more information: http://php.net/register_globals # To verify that this option has been set to OFF, open the Manager and choose # Reports -> System Info and then click the phpinfo() link. Do a Find on Page # for "register_globals". The Local Value should be OFF. If the Master Value # is OFF then you do not need this directive here. # IF REGISTER_GLOBALS DIRECTIVE CAUSES 500 INTERNAL SERVER ERRORS : # Your server does not allow PHP directives to be set via .htaccess. In that # case you must make this change in your php.ini file instead. If you are # using a commercial web host, contact the administrators for assistance in # doing this. Not all servers allow local php.ini files, and they should # include all PHP configurations (not just this one), or you will effectively # reset everything to PHP defaults. Consult www.php.net for more detailed # information about setting PHP directives. #php_flag register_globals Off # For servers that support output compression, you should pick up a bit of # speed by un-commenting the following lines. #php_flag zlib.output_compression On #php_value zlib.output_compression_level 5 # The following directives stop screen flicker in IE on CSS rollovers. If # needed, un-comment the following rules. When they're in place, you may have # to do a force-refresh in order to see changes in your designs. #ExpiresActive On #ExpiresByType image/gif A2592000 #ExpiresByType image/jpeg A2592000 #ExpiresByType image/png A2592000 #BrowserMatch "MSIE" brokenvary=1 #BrowserMatch "Mozilla/4.[0-9]{2}" brokenvary=1 #BrowserMatch "Opera" !brokenvary #SetEnvIf brokenvary 1 force-no-vary ### **.htaccess для Drupal** # Apache/PHP/Drupal settings: # Protect files and directories from prying eyes. Order allow,deny # Don't show directory listings for URLs which map to a directory. Options -Indexes # Follow symbolic links in this directory. Options +FollowSymLinks # Make Drupal handle any 404 errors. ErrorDocument 404 /index.php # Force simple error message for requests for non-existent favicon.ico. # There is no end quote below, for compatibility with Apache 1.3. ErrorDocument 404 "The requested file favicon.ico was not found. # Set the default handler. DirectoryIndex index.php index.html index.htm # Override PHP settings that cannot be changed at runtime. See # sites/default/default.settings.php and drupal_initialize_variables() in # includes/bootstrap.inc for settings that can be changed at runtime. # PHP 5, Apache 1 and 2. php_flag magic_quotes_gpc off php_flag magic_quotes_sybase off php_flag register_globals off php_flag session.auto_start off php_value mbstring.http_input pass php_value mbstring.http_output pass php_flag mbstring.encoding_translation off # Requires mod_expires to be enabled. # Enable expirations. ExpiresActive On # Cache all files for 2 weeks after access (A). ExpiresDefault A1209600 # Do not allow PHP scripts to be cached unless they explicitly send cache # headers themselves. Otherwise all scripts would have to overwrite the # headers set by mod_expires if they want another caching behavior. This may # fail if an error occurs early in the bootstrap process, and it may cause # problems if a non-Drupal PHP file is installed in a subdirectory. ExpiresActive Off # Various rewrite rules. RewriteEngine on # Block access to "hidden" directories whose names begin with a period. This # includes directories used by version control systems such as Subversion or # Git to store control files. Files whose names begin with a period, as well # as the control files used by CVS, are protected by the FilesMatch directive # above. # NOTE: This only works when mod_rewrite is loaded. Without mod_rewrite, it is # not possible to block access to entire directories from .htaccess, because # is not allowed here. # If you do not have mod_rewrite installed, you should remove these # directories from your webroot or otherwise protect them from being # downloaded. RewriteRule "(^|/)\." - [F] # If your site can be accessed both with and without the 'www.' prefix, you # can use one of the following settings to redirect users to your preferred # URL, either WITH or WITHOUT the 'www.' prefix. Choose ONLY one option: # To redirect all users to access the site WITH the 'www.' prefix, # (http://example.com/... will be redirected to http://www.example.com/...) # uncomment the following: # RewriteCond %{HTTP_HOST} !^www\. [NC] # RewriteRule ^ http://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301] # To redirect all users to access the site WITHOUT the 'www.' prefix, # (http://www.example.com/... will be redirected to http://example.com/...) # uncomment the following: # RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC] # RewriteRule ^ http://%1%{REQUEST_URI} [L,R=301] # Modify the RewriteBase if you are using Drupal in a subdirectory or in a # VirtualDocumentRoot and the rewrite rules are not working properly. # For example if your site is at http://example.com/drupal uncomment and # modify the following line: # RewriteBase /drupal # If your site is running in a VirtualDocumentRoot at http://example.com/, # uncomment the following line: # RewriteBase / # Pass all requests not referring directly to files in the filesystem to # index.php. Clean URLs are handled in drupal_environment_initialize(). RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_URI} !=/favicon.ico RewriteRule ^ index.php [L] # Rules to correctly serve gzip compressed CSS and JS files. # Requires both mod_rewrite and mod_headers to be enabled. # Serve gzip compressed CSS files if they exist and the client accepts gzip. RewriteCond %{HTTP:Accept-encoding} gzip RewriteCond %{REQUEST_FILENAME}\.gz -s RewriteRule ^(.*)\.css $1\.css\.gz [QSA] # Serve gzip compressed JS files if they exist and the client accepts gzip. RewriteCond %{HTTP:Accept-encoding} gzip RewriteCond %{REQUEST_FILENAME}\.gz -s RewriteRule ^(.*)\.js $1\.js\.gz [QSA] # Serve correct content types, and prevent mod_deflate double gzip. RewriteRule \.css\.gz$ - [T=text/css,E=no-gzip:1] RewriteRule \.js\.gz$ - [T=text/jаvascript,E=no-gzip:1] # Serve correct encoding type. Header append Content-Encoding gzip # Force proxies to cache gzipped & non-gzipped css/js files separately. Header append Vary Accept-Encoding ### **.htaccess для Opencart** Options +FollowSymlinks RewriteEngine On RewriteBase / RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule ^([^?]*) index.php?_route_=$1 [L,QSA] ### **.htaccess для Webasyst** Deny from all DirectoryIndex index.php Options -Indexes # Comment the following line, if option Multiviews not allowed here Options -MultiViews AddDefaultCharset utf-8 RewriteEngine On # Uncomment the following line, if you are having trouble RewriteBase / RewriteCond %{REQUEST_URI} !\.(js|css|jpg|jpeg|gif|png|svg|ttf|eot|otf|woff|woff2)$ [or] RewriteCond %{REQUEST_URI} apple-touch-icon\.png$ [or] RewriteCond %{REQUEST_METHOD} ^(POST|PUT|COPY|MOVE|DELETE|PROPFIND|OPTIONS|MKCOL)$ [or] RewriteCond %{HTTP:Translate} ^.+$ [or] RewriteCond %{HTTP_USER_AGENT} ^(DavClnt|litmus|gvfs|davfs|wdfs|WebDAV|cadaver|Cyberduck) RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule ^(.*)$ index.php [L,QSA] Header set Cache-Control "max-age=3153600, public" ### **.htaccess для PrestaShop** # ~~start~~ Do not remove this comment, Prestashop will keep automatically the code outside this comment when .htaccess will be generated again # .htaccess automaticaly generated by PrestaShop e-commerce open-source solution # http://www.prestashop.com - http://www.prestashop.com/forums ### **.htaccess для Joomla** # @version $Id: htaccess.txt 14401 2010-01-26 14:10:00Z louis $ # @package Joomla # @copyright Copyright (C) 2005 - 2010 Open Source Matters. All rights reserved. # @license http://www.gnu.org/copyleft/gpl.html GNU/GPL # Joomla! is Free Software ##################################################### # READ THIS COMPLETELY IF YOU CHOOSE TO USE THIS FILE # # The line just below this section: 'Options +FollowSymLinks' may cause problems # with some server configurations. It is required for use of mod_rewrite, but may already # be set by your server administrator in a way that dissallows changing it in # your .htaccess file. If using it causes your server to error out, comment it out (add # to # beginning of line), reload your site in your browser and test your sef url's. If they work, # it has been set by your server administrator and you do not need it set here. ##################################################### ## Can be commented out if causes errors, see notes above. Options +FollowSymLinks # mod_rewrite in use RewriteEngine On ########## Begin - Rewrite rules to block out some common exploits ## If you experience problems on your site block out the operations listed below ## This attempts to block the most common type of exploit `attempts` to Joomla! # ## Deny access to extension xml files (uncomment out to activate) # #Order allow,deny #Deny from all #Satisfy all # ## End of deny access to extension xml files RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR] # Block out any script trying to base64_encode crap to send via URL RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR] # Block out any script that includes a