• Resolved leejosepho

    (@leejosepho)


    I use WordFence Security to monitor incoming stuff so I can deal with any “Page Not Found” errors that might be my fault, and here is the current one I am still uncertain about:
    https://www.nonameyet.org/step-four-we-reviewed-our-fears-thoroughly/\"

    I had thought about coming here and asking you about that, and here is what WordFence reports:

    Time: 28 mins ago — Thu, 23 Oct 14 03:40:35 -0500 — 1414053635.400216 in Unixtime
    Secs since last hit: 0.0000
    URL: Possible XSS code filtered out for your security
    Type: Page not found
    Full Browser ID: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.02
    Location: United States Los Angeles, United States

    IP: 162.244.15.179
    (And then after a lookup:)
    Sorry, but no data for that IP or domain was found.

    My initial question for you would have been about whether I need to or even should add a redirect for that link to go where it would go if the \" were not on the end, but I think I now know the answer to that question…and here is how I got there:

    I made a Redirect and tried it by using my BPS Current htaccess editor and then clicking on the bad link, then my Dashboard broke and I next found myself looking at the front of my site in some kind of FTP mode with no theme. I next clicked back to my Dashboard and discovered BPS had just blocked a line of my added htaccess and had added a note-of-explanation concerning something about an Options line I had added along with that Redirect code I had gotten from an online generator.

    This is probably more of a kudos kind of thread than a support question, but did BPS just carry me safely through a bit of fire?

    https://www.ads-software.com/plugins/bulletproof-security/

Viewing 15 replies - 16 through 30 (of 42 total)
  • Plugin Author AITpro

    (@aitpro)

    Ok then do that then. Sounds good to me.

    Thread Starter leejosepho

    (@leejosepho)

    I apologize if I have seemed to be a nuisance here. I learn *much* from you and from your willingness to occasionally go above-and-beyond in relation to BPS support.

    Here is my most-recent discovery as to why I have to deal with two .htaccess files for my Primary Domain, and I now understand why/how that might have caused some confusion here with some of these questions I had been asking…

    https://www.ads-software.com/support/topic/seeking-your-opinion-on-the-location-of-a-primary-domain?replies=4#post-6231383

    Plugin Author AITpro

    (@aitpro)

    Yep top notch support is very important to us so we always go above and beyond with helping folks. Thanks. ??

    Thread Starter leejosepho

    (@leejosepho)

    Now that I have this all sorted out, I do have just one more request for some of your expertise…

    Yesterday I found some code related this:

    Since search engines index URLs, having multiple URLs in the index that point to the same content page divides the available page rank credit for that page among those URLs. This is definitely a “not optimized for search” state of affairs!

    https://www.internetmarketingninjas.com/blog/search-engine-optimization/301-redirects/

    Since then, I have added the following to all of my sites other than the sub-domain. For example:

    #   BULLETPROOF .51.2 >>>>>>> SECURE .HTACCESS
    # CUSTOM CODE TOP PHP/PHP.INI HANDLER/CACHE CODE
    ## Redirect nnysandbox.net to www.nnysandbox.net
    RewriteCond %{HTTP_HOST} !^www\.nnysandbox\.net
    RewriteRule (.*) https://www.nnysandbox.net/$1 [R=301,L]
    ##
    # Use PHP5.4 Single php.ini as default
    AddHandler application/x-httpd-php54s .php

    However, my efforts get the proper slashes in the proper places for my sub-domain have all been miserable failures. So if you might be willing:

    ## Redirect nnysandbox.net/b6_development to www.nnysandbox.net/b6_development
    RewriteEngine on
    RewriteCond %{HTTP_HOST} !^www\.domain\.com
    RewriteRule (.*) https://www.domain.com/$1 [R=301,L]
    Plugin Author AITpro

    (@aitpro)

    I don’t see any relationship of the SEO info above to asking about how to rewrite non-www to www URLs.

    You will find non-www to www and www to non-www rewriting code in this forum topic: https://forum.ait-pro.com/forums/topic/htaccess-redirect-www-to-non-www-htaccess-redirect-non-www-to-www/#post-5566

    Plugin Author AITpro

    (@aitpro)

    Also that code needs to be incorporated INTO the WordPress Rewrite loop. You cannot use it as stand-alone code if these are WordPress websites.

    Thread Starter leejosepho

    (@leejosepho)

    I don’t see any relationship of the SEO info above to asking about how to rewrite non-www to www URLs.

    This link I posted suggests this for that:

    #Once you understand canonicalization best practices, you’ll want to implement them on your site.
    #That means you must account for all redirecting possible alternative URL variations to the canonical URL.
    #Use the following code sample for your site’s home page:
    #---
    RewriteCond %{HTTP_HOST} ^xyz\.com [NC]
    RewriteRule ^(.*)$ https://www.xyz.com/$1 [L,R=301]
    RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /([^/]+/)*(default|index)\.(html|php|htm)\ HTTP/ [NC]
    RewriteRule ^(([^/]+/)*)(default|main|index)\.(html|php|htm)$ https://www.xyz.com/$1 [L,R=301]
    #---
    #The first two-line block of code redirects URLs that have omitted the “www.” prefix to the full “www.xyz.com” home page URL.
    #That means the home page URL https://xyz.com will not resolve on its own, but instead will redirect to https://www.xyz.com/.
    #The second code block redirects URLs specifying default page references to the URL that omits default page reference names.
    #This code ensures that any home page URL that includes several versions of explicit page name references,
    #such as default.htm or index.html, will be redirected to the canonical home page URL, https://www.xyz.com/.

    However, I opted for the simpler version I found, then added that in at the top of BPS Custom Code where I assume it ends up “incorporated INTO the WordPress Rewrite loop”, as you have mentioned. So, I now just need/wish to do the same at the top of BPS Custom Code for my sub-domain.

    Plugin Author AITpro

    (@aitpro)

    Oh ok I see what the article meant now. I misunderstood the info. Yes, you do not want to have both non-www and www URL’s indexed or other duplicate posts such as an HTML and a PHP version with the same exact content. That would be very bad for SEO/SERPS.

    Nope that is the wrong place in your htaccess file. See the link I posted above for where you need to add whichever code you want to add. It needs to be incorporated/integrated into the WordPress Rewrite code.

    Plugin Author AITpro

    (@aitpro)

    Let me rephrase that another way. You can use whichever code you choose to use, but it is VERY IMPORTANT where that code goes in your root .htaccess file. The link above shows the correct Custom Code text box for where to add your custom code and you will need to combine into the existing WP REWRITE LOOP Start code.

    Plugin Author AITpro

    (@aitpro)

    Example using the code you posted above:

    # WP REWRITE LOOP START
    RewriteEngine On
    RewriteBase /
    RewriteCond %{HTTP_HOST} ^xyz\.com [NC]
    RewriteRule ^(.*)$ https://www.xyz.com/$1 [L,R=301]
    RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /([^/]+/)*(default|index)\.(html|php|htm)\ HTTP/ [NC]
    RewriteRule ^(([^/]+/)*)(default|main|index)\.(html|php|htm)$ https://www.xyz.com/$1 [L,R=301]
    RewriteRule ^index\.php$ - [L]
    Plugin Author AITpro

    (@aitpro)

    Otherwise if you add your custom code as stand-alone code then I am pretty sure you are going to have an infinite redirect loop problem.

    Thread Starter leejosepho

    (@leejosepho)

    Yes, understood, and I definitely want BPS to handle it all.

    Doing my best to follow your instructions precisely, I presently have the following in the proper BPS Custom Code box:

    # CUSTOM CODE WP REWRITE LOOP START - Your Custom htaccess code will be created here with AutoMagic
    # WP REWRITE LOOP START
    RewriteEngine On
    RewriteBase /
    # add non-www to www
    # from https://forum.ait-pro.com/forums/topic/htaccess-redirect-www-to-non-www-htaccess-redirect-non-www-to-www/#post-5566
    RewriteCond %{HTTP_HOST} ^nnysandbox\.net$ [NC]
    RewriteRule ^(.*)$ https://www.nnysandbox.net/$1 [R=301,L]
    #
    RewriteRule ^index\.php$ - [L]

    Question: Are you absolutely certain I *must* add my ‘foldername’ to RewriteBase / ? This is a BlueHost Add-On Domain, not what we know as a sub-domain out beyond ‘/home/myaccount/’ or whatever, and cPanel already points that domain directly to its actual location where Dashboard > Settings > General shows only https://www.nnysandbox.net in both boxes.

    Other than having saved the above in the Custom Code box, I have yet to go any farther until I know about that and also about whether I will later have to go to Current Root for further editing since the link you provided mentions nothing about that for adding non-www to www, only for the removal of www.

    Plugin Author AITpro

    (@aitpro)

    BPS will automatically create the correct RewriteBase. Whatever BPS has created is correct. An Add-on or subdomain site is a root site and has / for the RewriteBase. A subfolder installation with have a folder name.

    Examples:
    /public_html/ is a root site
    /public_html/SiteA.com/ is a root site
    /public_html/SiteA.com/subfolder-installation/ is a subfolder site and will have a RewriteBase of /subfolder-installation/

    Plugin Author AITpro

    (@aitpro)

    BPS will automatically create the correct RewriteBase

    Assuming you have not changed the default BPS code already. Once you add your custom code then your custom code will be used instead of BPS default/standard code. That is why you want to copy the BPS root htaccess code to Custom Code and then modify it in Custom Code – so that you are starting with the correct standard code.

    Thread Starter leejosepho

    (@leejosepho)

    Assuming you have not changed the default BPS code already. Once you add your custom code then your custom code will be used instead of BPS default/standard code. That is why you want to copy the BPS root htaccess code to Custom Code and then modify it in Custom Code – so that you are starting with the correct standard code.

    I never alter BPS code, I only add pieces you have suggested other than having recently added this I have already mentioned at the top of “Your Current Root htaccess File” to try it out:

    #   BULLETPROOF .51.2 >>>>>>> SECURE .HTACCESS
    # CUSTOM CODE TOP PHP/PHP.INI HANDLER/CACHE CODE
    ## Redirect nnysandbox.net to www.nnysandbox.net
    RewriteCond %{HTTP_HOST} !^www\.nnysandbox\.net
    RewriteRule (.*) https://www.nnysandbox.net/$1 [R=301,L]
    ##

    Having altogether missed including the RewriteEngine On there, I doubt those lines actually did anything, but all my redirects added immediately below that worked perfectly. Since then, however, I have added the BPS version of “non-www to www” we have been talking about, and I did that in the proper box lower down…and now none of my redirects work at all whether still at the top where they were or directly under (in the same box as) the BPS “non-www to www” code. But, tomorrow is another day and maybe some new thought or approach will appear in the morning!

    A couple of notes from along the way: It surprised me quite a bit to see BPS picking up code from my Current Root htaccess File and bringing it on in while processing my Custom Code to make a new secure.htaccess file. To stop that from happening, I ended up deleting my Current file completely before trying again to make a new secure.htaccess. I am also uncertain about how to deal rightly with all the “You MUST copy…” notices in the Custom Code area when nothing already there is going to being edited. Logic suggests “You MUST copy…IF you intend to edit…”, but that is not what it says. But, I went ahead and copied those things over anyway this time, and then some of the results I saw were quite surprising when those non-edited things showed up differently in the newly-made secure.htaccess.

Viewing 15 replies - 16 through 30 (of 42 total)
  • The topic ‘I think Bulletproof just stopped me from damaging my own site’ is closed to new replies.