Disable Trace and Track for Better Security

Dean – #1

Hey Jeff,

Is the below code best practice for .htaccess files?

RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]

Regards,

- Dean (Sydney, Australia)

Rick Beckman – #3

Hey, Jeff, thanks for the code. I’m running on Dreamhost, and they provide the ability to have an account-wide .htaccess file — an .htaccess file that is processed for every domain on a user’s account — and some things work in this file, others don’t.

This code at least doesn’t crash my site — some perfectly valid code, when used in the account-wide file, does crash things — but I’m not sure if it’s actually working.

Do you know of a way to test those request methods against a site?

Rick Beckman – #4

Oh, never mind, I’m just dense. I tested it by adding in the GET method as well. It didn’t block requests, so I’ll have to do this the long way, adding to each of my domain’s .htaccess files.

Here’s a request: Work up a tutorial on how to modify one .htaccess file and have it reflected across as many other files as desired (via Shell/cron/whatever), making sure that site-specific code (such as WP’s permalink code) isn’t touched. So, for example, a “# Account-wide declarations” block could be copied to each file automatically. That sure would be handy!

duck – #5

How do you check whether TRACE and TRACK are enabled or disabled?

Thomas Scholz – #6

I recommend to add DELETE to the list:

RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK)

Rick Beckman – #8

I know that, Jeff. What I’d like to be able to do is apply a variety of security functions to all of my domains (each reside in its own directory within my home directory), and manually updating each domain’s .htaccess to account for new security rules is tedious. Being able to update them all in one go would be awesome.

Rick Beckman – #10

I can create such an .htaccess file — it works with the allow/deny rules and various other things, but mod_rewrite doesn’t work for it.

And unfortunately, on Dreamhost regular hosting, no access to real config files. :S

Rick Beckman – #12

Nah, there isn’t a primary domain. The structure of my account looks like this when I log in via FTP:

/

domain.com
domain2.com
domain3.com

Each individual domain’s folder is the root folder for that domain (i.e., there isn’t a child public_html/ or www/ or anything of that nature), and each domain’s folder (and all subsequent children) can have fully-functional .htaccess files.

The / directory itself, though, is a bit limited. It’s above the Web root, so mod_rewrite doesn’t seem to work — either that’s the reason, or it just isn’t enabled that high up.

I do, however, maintain all of my configuration files (wp-config.php files, for example) in the / directory, so what I may end up doing is writing a security PHP script that checks user-agents, IPs, requests, and so on. Then all I’d need to do is include it at the top of the wp-config.php file.

That method likely won’t be *as* quick as .htaccess (and definitely not as quick as the http.conf file), but it will be slightly quicker than maintaining it all as an actual WordPress plugin as the included security file would launch almost immediately on page access.

That’ll be a stop-gap. I’m going to look at how WordPress generates .htaccess rules, modifying.htaccess files in such a way as to not modify any other custom-added content… I might be able to write a PHP script that, when one, copies one .htaccess file to as many others as I want.

By default on my server, PHP can modify just about any files — I rarely have to CHMOD anything — and whether that’s a bad thing or not, I dunno. It is danged convenient for me, though. If I ever get something workable, I’ll share the code.

John Hoff - WP Blog Host – #14

Looks like this is in the 4G Blacklist. I just checked my .htaccess file and there it was. Cool.

Thanks - sent out a tweet.

Jordan Ogren – #15

I have the following in my .htaccess from the 4G Blacklist:

# FILTER REQUEST METHODS
<IfModule mod_rewrite.c>
 RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK) [NC]
 RewriteRule ^(.*)$ - [F,L]
</IfModule>

I am assuming, like John Hoff, that this has me covered. Am I correct?

Thomas Scholz – #17

Jordan, remove HEAD from your list. This is a Good Thing.

Let’s say, someone checks the links on his website to find and remove outdated URLs: His script will use HEAD to verify that the linked pages are still there. If your response code isn’t 200 the link will probably be removed.

Forbidding HEAD means forbidding links from well maintained web sites.

Jordan Ogren – #19

@Jeff and @Thomas,

Thanks guys, I really appreciate your shared knowledge.

Greg – #20

Pretty agree with Thomas too, for the HEAD.
But HEAD can also help to find the server version, if the owner set the server signature off.

Nan – #21

Hi Jeff! I would like to add this to my htaccess:

# FILTER REQUEST METHODS

RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK) [NC]
RewriteRule ^(.*)$ - [F,L]

But I have already:

# BEGIN WordPress

RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

# END WordPress

Can I have 2 or 3 different in the same htaccess?

Also, you say to put: RewriteRule .* - [F] and Jordan put: RewriteRule ^(.*)$ - [F,L] So what does the L stand for? Should I put it or not?

Thank you so much for your tips!!