Category: Security

  • htaccess: Block bad bots for security purposes

    Please double check any bots you wish to allow are not in the block list. This is a list of known bots, as well as default user agents.

    I have had a scenario where a website was getting scraped by a number of bots, causing excessive resource usage on the server and disrupting sales and bad experience for real customers.

    Here is a basic technique to stop those pesky bots, simply add the following to your .htaccess file. You may need to modify the exceptions at the top if you do require certain files to be accessed by bots. Currently it will allow access to robots.txt and acme-challenge for LetsEncrypt.

  • htaccess: HTTP to HTTPS redirect

    It is recommended to you SSL on your website even when not required. Google Chrome and other browsers have begun to flag non-SSL websites as insecure. Don’t lose your visitors due to appearing as an insecure website.

    With the introduction of LetsEncyrpt and other free SSL certificate providers, there is no reason for websites to not be secured. Google Chrome is now beginning to flag websites which are non-HTTPS as secure leading to your visitors and customers believe your website is insecure. Make sure your using and SSL and redirecting all non-HTTP traffic to HTTPS using the below htaccess config setting for Apache.