Quickly securing server config .htaccess and improving performance

If you need to configure your apache via .htaccess file (for example giving custom config overriding feature to non-root users on the system and not to affect/misconfigure other web sites, except their own) config .htaccess is a good solution to solve this problem.

By default, I suggest turning off override for root directory:
<Directory>
AllowOverride None

</Directory>

and only activating .htaccess file overring feature for required directory or web site:
<Directory /etc/webs/www.domain.com/public_html/>
AllowOverride All

</Directory>

In the above case, we allow AllowOverride All to /etc/webs/www.domain.com/public_html/ folder.

If we define/enable .htaccess to the exact dir we require it to be enabled, the web server will have better performance – no need to lookup every directory recursively to check if .htaccess support is enabled for the particular directory – thus, resulting in better performance and of course, security level is boosted as well.

Don’t forget that you can turn off .htaccess feature as defined above, and move all .htaccess configuration lines with proper syntax to http configuration file. This is the BEST way :)


Leave a Reply