## Security portion of the .htaccess 
# TOC: 
#   1. suspicious POST requests;
#	2. Various other attacks;

#-------------------------------------------------------------
# 1. http://perishablepress.com/protect-post-requests/
#-------------------------------------------------------------

# whitelist POST requests: any direct access to php files must be explicitly added here;
# the /cli files need not be inserted as they are invoked by 127.0.0.1
<IfModule mod_rewrite.c>
	RewriteCond %{REQUEST_METHOD} POST
	RewriteCond %{REQUEST_URI} !/index.php [NC]
	RewriteCond %{REQUEST_URI} !/administrator/index.php [NC]
	RewriteCond %{REQUEST_URI} !/components/com_littlehelper/littlehelper.php [NC]
	RewriteCond %{REMOTE_ADDR} !127.0.0.1 
	RewriteRule .* - [F,L]
</IfModule>

#-------------------------------------------------------------
# 2. https://docs.joomla.org/Htaccess_examples_%28security%29
#-------------------------------------------------------------

 ServerSignature Off
 RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK) [NC,OR]
 RewriteCond %{THE_REQUEST} (\\r|\\n|%0A|%0D) [NC,OR]
 
 RewriteCond %{HTTP_REFERER} (<|>|’|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
 RewriteCond %{HTTP_COOKIE} (<|>|’|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
 RewriteCond %{REQUEST_URI} ^/(,|;|:|<|>|”>|”<|/|\\\.\.\\).{0,9999} [NC,OR]
 
 RewriteCond %{HTTP_USER_AGENT} ^$ [OR]
 RewriteCond %{HTTP_USER_AGENT} ^(java|curl|wget) [NC,OR]
 RewriteCond %{HTTP_USER_AGENT} (winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner) [NC,OR]
 RewriteCond %{HTTP_USER_AGENT} (libwww-perl|curl|wget|python|nikto|scan) [NC,OR]
 RewriteCond %{HTTP_USER_AGENT} (<|>|’|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
 
 #Block mySQL injects
 RewriteCond %{QUERY_STRING} (;|<|>|’|”|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|cast|set|declare|drop|update|md5|benchmark) [NC,OR]
 
 RewriteCond %{QUERY_STRING} \.\./\.\. [OR]
 
 RewriteCond %{QUERY_STRING} (localhost|loopback|127\.0\.0\.1) [NC,OR]
 RewriteCond %{QUERY_STRING} \.[a-z0-9] [NC,OR]
 RewriteCond %{QUERY_STRING} (<|>|’|%0A|%0D|%27|%3C|%3E|%00) [NC]
 # Note: The final RewriteCond must NOT use the [OR] flag.
 
 # Return 403 Forbidden error.
 RewriteRule .* index.php [F]
 
 
 
 
 
 
 
 
 
 
 
 