Textpattern Support Forum

Just use password funtion of .htaccess file, placed in /textpattern/ folder. But this needs some thinking about – css.php из inside this folder, so, you visitrs can “miss” you styles, if they are called by tag txp:css

Micky

Great question. I’d like to see what others are doing. Here’s part of an experimental .htaccess I have on one site and it seems to work…

DirectoryIndex index.php index.html

#Options +FollowSymLinks
Options -Indexes

<IfModule mod_rewrite.c>
	RewriteEngine On
	#RewriteBase /relative/web/path/

	#
	#	Protect specific /textpattern folders by preventing Indexes and webfile access even if
	# Options -Indexes isn't allowed. 
	#
	RewriteRule ^textpattern/lang/.* index.php
	RewriteRule ^textpattern/tmp/.* index.php
	RewriteRule ^textpattern/lib/.* index.php
	RewriteRule ^textpattern/include/.* index.php
	RewriteRule ^textpattern/publish/.* index.php
	RewriteRule ^textpattern/update/.* index.php
	#
	#	Uncomment the following line if you are using cnk_versioning or hcg_templates...
	#
	#RewriteRule ^textpattern/_templates/.* index.php
	#
	#	Uncomment the following line (adjust the path if needed) if your plugin-cache directory is under your site root...
	#
	#RewriteRule ^textpattern/plugins/.* index.php

	#
	#	Otherwise, allow access to all existing files...
	#
	RewriteCond %{REQUEST_FILENAME} -f [OR]
	RewriteCond %{REQUEST_FILENAME} -d
	RewriteRule ^(.+) - [PT,L]

	#
	#	But redirect all remaining access attempts to the public index script...
	#
	RewriteRule ^(.*) index.php

	RewriteCond %{HTTP:Authorization}  !^$
	RewriteRule .* - [E=REMOTE_USER:%{HTTP:Authorization}]
</IfModule>

#php_value register_globals 0

I recommend turning off indexes unless you specifically need them. The .htaccess posted above does this but it might not work on your host if they don’t allow indexing to be turned off in .htaccess files. In that case, an alternative would be to ask your host to turn off indexes on your site in its virtual host file and failing that, just add a simple static index.html or index.php that redirects to the site root into every directory you don’t want Apache to index automatically.

Also make sure that your setup directory has been removed after you install textpattern.

Last edited by net-carver (2008-10-31 07:24:44)

Do you mean the actual /textpattern/ folder as opposed to the root Bert?

thebombsite wrote:

Do you mean the actual /textpattern/ folder as opposed to the root Bert?

Yes, right alongside the config.php file.

[This was added to the wiki a long while ago, Renaming the Textpattern Admin Directory for Added Security.] Ed. That link is now obsolete, see revision details.

Last edited by Destry (2008-11-03 22:03:35)