htaccess help required

[MrPlow]

My joomla based website is getting hacked on a daily basis. I'm trying to setup a whitelist while still allowing the search engines access.

I'd like the htaccess to only allow the major search engines and the IP's I specify to gain access. The IP's which are not on the whitelist I'd like to redirect to a contact form (contact.html).

From the research I've done:

ErrorDocument 403 /contact.html
order deny,allow
deny from all
allow from xxx.xxx.xxx.xxx

I'm struggling to find a suitable way of allowing the major search engines access.

I'd just like to be 100% sure everything is right before I add the htaccess file.


I understand my main priority should be building a more secure site, but I'd like to allow the exisitng users access to the current site until I've resolved the security issue.

Any help would be appreciated

MrPlow Reviewed by MrPlow on 10th Nov 2011. htaccess help required My joomla based website is getting hacked on a daily basis. I'm trying to setup a whitelist while still allowing the search engines access. I'd like the htaccess to only allow the major search engines and the IP's I specify to gain access. The IP's which are not on the whitelist I'd like to redirect to a contact form (contact.html). From the research I've done: ErrorDocument 403 /contact.html order deny,allow deny from all allow from xxx.xxx.xxx.xxx Rating: 5

[StyXoN]

http://perishablepress.com/press/200...access-tricks/

[Mrgeek]

maybe it's your hosting company servers that could be compromised which could lead to your site getting hacked..

1. change the folder name of your admin cp
2. allow ip only to your admin cp
3. look up current vulnerabilities and joomla

[MrPlow]

Thanks for the replies.

I've already confirmed with my hosting company that joomla was exploited and not the cpanel. I'm using the latest build of joomla 1.5, I've considered updating to 1.7 but due to my current templates and plugins not being compatable with 1.7 it would take a lot of time.

The last time I got hacked it ended up infecting some of the users machines, so I don't really want to do a few things and wait and see if I get hacked again tonight.

I thought the htaccess method would be best thing to do until I can get a new site built.

Thanks again