Konfigurationsmöglichkeiten für Ihre Website

.htaccess files

The webserver's behaviour can be influenced with .htaccess files. Despite the name, .htaccess files can be used for much more than access control.

The rules in an .htacess file apply to the directory that contains the file, as well as all sub-directories, as long as they are not overwritten by another .htaccess file.

Which directives can be used in .htaccess files, depends on wether the directory belongs to a site in the standard hosting or a personal homepage. For the standard hosting, generally all directives that valid in a .htacess are allowed. This is called context in the documentation. For personal homepages, directives of type Options are excluded.

Below are some usage examples for .htaccess files. Please look at the official Apache webserver documentation for further information.

Example: Force secure connection

To make the site accessible exclusively via HTTPS – i. e. encrypted – you can use the following .htaccess snippet.

Example: Force secure connection plus redirect

If your site – for whatever reason – can be contacted under several names, but always shows the same content, it is called Duplicate Content. The following lines will redirect all request to one main name (www.example.com in the example) and at the same time enforce a secure connection method (HTTPS) similar to the example above.

The examples above enforce encryption effectively and robust. Similar directed settings in some web applications often do not, and should be used at most in addition then.

Example: Block directory access

Sometimes it is necessary to block all access to a certain directory. This mostly concerns the protection of configuration or password files, that are not to be served by the webserver. An option is to place the files in a directory outside of the DocumentRoot. The following directive blocks all requests to a directory.

Example: Password authentification

A simple password protection for a directory can be implemented using a .htaccess file and a seperate password file.

Create password file

The password file is a simple text file, that has one line for each user or account. The format is like this:

Name:encrypted password

The file can be created and managed using the command htpasswd that is available at the access hosts. The file created must not be stored in directory that is publicly readable (see example).

Create .htaccess file

The file must be placed in the directory that is to be protected. The following block triggers the authentification and ensures, that the passwords will be transmitted over an encrypted connection.

<If "%{ENV:HTTPS} !~ /on/i">
   RewriteEngine On
   RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [redirect=permanent,last]
</If>
<Else>
   AuthType Basic
   AuthName "Mein interner Bereich"
   AuthUserFile /nfs/web_mwn/www/x/kennung/webserver/config/pwd_datei
   Require valid-user
</Else>

• AuthName is an arbitrary text that designates the realm for the authentication. The text may be shown by browsers in the password dialogue.
• AuthUserFile sets the path to the password file.
• Require valid-user allows all entries from the password file. You can also list (separated by with spaces) individual names instead of valid-user können auch einzelne Namen (mit Leerzeichen getrennt) aufgelistet werden.

More information on blocking or granting access can be found in the Apache documentation article Access Control.

.user.ini files

PHP includes support for configuration INI files on a per-directory basis. This functionality is basically available in the standard hosting. Read more about this in the PHP manual