A Generic .htaccess File

# Place a .htaccess file in each directory you want to protect.
########################################################################
#                    SECURITY / ACCESS CONTROL                         #
# If the web server's AllowOverride allows AUTHCONFIG to be overridden #
########################################################################
#
# Save both .htpasswd and .htgroup files in a directory above "documentroot" directory
# (e.g. not in or below /apache/htdocs) but could be below "serverroot" directory
# (e.g. below /apache).

# This will pop-up a user/password dialog box saying Realm = 
AuthName "Restricted Area"

# AuthType is normally basic.  Not very secure until "Digest" type becomes prevalent
AuthType basic

# If value of AuthUserFile doesn't begin with a slash, it is treated as
# relative to the ServerRoot (not DocumentRoot!)
AuthUserFile "/userhome/blahBlah/.htpasswd"
AuthGroupFile "/userhome/blahBlah/.htgroup"

# Each line of the user file contains a username followed by a colon, followed by the crypt()
# encrypted password. The behavior of multiple occurrences of the same user is undefined. 
# You can generate a password file on your system by typing commands on the OS prompt as follows:
#    htpasswd -c Filename username     # Creates a password file 'Filename' with 'username'
# 			               # as the first user. It will prompt for the new password.
#    htpasswd Filename username2       # Adds or modifies in password file 'Filename' the 'username2'. 
#
# Each line of the group file contains a groupname followed by a colon, followed by 
# the member usernames separated by spaces. For example, put this on one line in the .htgroup file:
# mygroup: bob joe anne

# This set to off will forward a not-found userid to the next-in-line module for authentication.
# 'On' is the default It is better that way.
#AuthAuthoritative off

# Now, we allow specific users or groups to get in.
# require user joe john mary
require valid-user
require group family friends

# More Authentication related, rarely used 
# AuthDBGroupFile 
# AuthDBUserFile 
# AuthDBAuthoritative 
# AuthDBMGroupFile 
# AuthDBMUserFile 
# AuthDBMAuthoritative 
# AuthDigestFile 
# AuthDigestGroupFile 
# AuthDigestQop 
# AuthDigestNonceLifetime 
# AuthDigestNonceFormat 
# AuthDigestNcCheck 
# AuthDigestAlgorithm 
# AuthDigestDomain 
# Using Digest Authentication


###############################################################################
# From here on, if something is not working as you might expect, try to make sure that 
# the corresponding AllowOverride is enabled in ,  or  sections
# of server configuarion files (generally httpd.conf, can be access.conf or srm.conf).
# Allowoverride could be:
# 1. AuthConfig (allows AuthName, AuthUserFile, require etc. in .htaccess file)
# 2. FileInfo (allows AddType, DefaultType, ErrorDocument etc. in .htaccess file) 
# 3. Indexes (allows DirectoryIndex, FancyIndexing, IndexOptions etc. in .htaccess file) 
# 4. Limit (allows use of allow, deny and order directives which control access by host)
# 5. Options (allows use of options directive in .htaccess file - see below)
# 6. All (allows all of the above in .htaccess file.  Rare)
# 7. None (allows none of the above in .htaccess file.  Rare)
# Usually, AuthConfig is allowed.  Rest is up to the particular web host company.
#
# If you get server errors after putting this file in, try disabling
# each section below one-by-one to see what your web hosting company
# allows (or you can ask them :)
###############################################################################


######################################################################
# If the web server's AllowOverride allows FILEINFO to be overridden #
######################################################################
# CookieTracking, AddType, DefaultType, AddHandler, Action, ErrorDocument
# Redirect, Redirectmatch, RedirectPermanent, RedirectTemp
# AddEncoding, AddCharset, AddLanguage, LanguagePriority, DefaultLanguage


#### Comment it out if UserTrack module is not loaded in the server
#CookieName "woiqatty"
#CookieTracking on

# Tweak mime.types without actually editing it, or make certain files to be certain types.
#AddType application/x-httpd-php3 .phtml
AddType application/x-httpd-php3 .php
AddType application/x-httpd-php3 .php3
AddType application/x-httpd-php3-source .phps
AddType application/x-tar .tgz

# In this directory, default filetype is this one if Server cannot
# otherwise determine from filename extensions.
# Mostly text or HTML - "text/plain", gif images - "image/gif", 
# compiled porgrams - "application/octet-stream"
DefaultType text/plain
# DefaultType image/gif
# DefaultType  application/octet-stream

################### THIS IS IMPORTANT! #####################
# AddHandler allows you to map certain file extensions to "handlers",
# actions unrelated to filetype. These can be either built into the server
# or added with the Action command (see below).
# If you want to use server side includes, or CGI outside
# ScriptAliased directories, uncomment the following lines.

# To use CGI scripts:
AddHandler cgi-script cgi pl

# To use server-parsed HTML files
AddType text/html .shtml
AddHandler server-parsed .shtml

# Example of a file whose contents are sent as is so as to tell the client that a file has redirected. 
# Status: 301 Now where did I leave that URL 
# Location: http://xyz.abc.com/foo/bar.html 
# Content-type: text/html 
# 
# <HTML> <HEAD> <TITLE> Lame excuses'R'us </TITLE></HEAD><BODY> 

# <H1>Fred's exceptionally wonderful page has moved to 
# <A HREF="http://xyz.abc.com/foo/bar.html">Joe's</A> site. 
# </H1></BODY></HTML> 
#
# Server always adds a Date: and Server: header to the data returned to the client, 
# so don't include these in the file.
#AddHandler send-as-is asis

# If you wish to use server-parsed imagemap files, use
AddHandler imap-file map

# For content negotiation use
#AddHandler type-map var

# Action lets you define media types that will execute a script whenever
# a matching file is called. This eliminates the need for repeated URL
# pathnames for oft-used CGI file processors.
# Format: Action action-type cgi-script
# Format: Action media/type /cgi-script/location
# Format: Action handler-name /cgi-script/location
#Action cgi-script /cgi-bin/default.cgi

# Redirect [status] ABSOLUTE-path-of-old-url new-url.  Default status is temp.
# Status is one of permanent (returns 301), temp (returns 302), 
# seeother (returns 303, see other document in same place), 
# gone (returns 410, no longer available at all) - Don't specify new-URL
# Here, if the client requests http://myserver/service/foo.txt, it will be told 
# to access http://foo2.bar.com/service/foo.txt instead. 
#Redirect /service http://foo2.bar.com/service

# Customizable error response.  Three styles:
# 1. Plain Text - the (") marks it as text, it does not get output
#ErrorDocument 500 "The server made a boo boo.
# 2. Local Redirects - e.g. To redirect to local URL /missing.html
#ErrorDocument 404 /missing.html
#ErrorDocument 404 /cgi-bin/missing_handler.pl
# 3. External Redirects (All env. variables don't go to the redirected location)
#ErrorDocument 402 http://some.other_server.com/subscription_info.html


# Mosaic/X 2.1+ browsers can uncompress information on the fly
AddEncoding x-compress Z
AddEncoding x-gzip gz tgz

#Content negotiation directives
#AddLanguage fr .fr
# Just list the languages in decreasing order of preference.
LanguagePriority en fr it

######################################################################
# If the web server's AllowOverride allows INDEXES to be overridden  #
######################################################################
# DirectoryIndex, ExpiresActive, ExpiresByType, ExpiresDefault
# ImapBase, ImapDefault, ImapMenu
# FancyIndexing, IndexOptions, IndexOrderDefault, IndexIgnore, HeaderName, ReadmeName
# AddDescription, AddAlt, AddAltByEncoding, AddAltByType
# AddIcon, AddIconByEncoding, AddIconByType, DefaultIcon

# Default file to send to the client if none specified.  
# Separate multiple entries with spaces.
# If none of these files exists in a directory, a directory listing may
# be returned depending on Options Indexes setting.
DirectoryIndex index.html index.htm index.shtml index.php index.php3 index.pl index.cgi /cgi-bin/index.cgi

# Must enable expirations to use other expire directives
#ExpiresActive on
# 'M' means that the file's last modification time should be used as the base time
# 'A' means the client's access time should be used as base time
#ExpiresDefault M604800
# Expire GIF images after a month in the client's cache
#ExpiresByType image/gif A2592000  
# HTML documents are good for a week from the time they were changed, period     
#ExpiresByType text/html M604800  
#ExpiresByType text/html "access plus 1 month 15 days 2 hours" 
#ExpiresDefault "modification plus 5 hours 3 minutes" 
#ExpiresByType text/html "now plus 1 month 15 days 2 hours"

# ImapMenu can be none, formatted, semiformatted, unformatted
ImapMenu semiformatted
# ImapDefault can be error, nocontent, map, referer, or some useful URL.
#  The .map file overrides this.
ImapDefault map
# ImapBase can be map, referer, URL.  The .map file overrides this.
ImapBase referer

############## THIS HERE IS NOT TOO IMPORTANT! ###################
# Apache version dependent.  If Options indexes is allowed, Server will behave as follows:
#IndexOptions FancyIndexing FoldersFirst NameWidth=* DescriptionWidth=*
#IndexOptions FancyIndexing NameWidth=*
#IndexOptions +IconHeight=20 +IconWidth=20 +IconsAreLinks
#IndexOptions +ScanHTMLTitles
#IndexOptions +SuppressColumnSorting 
#IndexOptions +SuppressDescription 
#IndexOptions +SuppressLastModified 
#IndexOptions +SuppressSize 
#IndexOptions SuppressHTMLPreamble
# Sort by Name, Date, Size, or Description? Default is name.
#IndexOrderDefault Ascending Name
# Don't list these files
#IndexIgnore .??* *~ *# HEADER* README* RCS CVS *,v *,t

# Server .conf should already have set these up.  You should only set
# the missing ones in .htaccess files (if you ever find out)
#AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip
#AddIconByType (TXT,/icons/text.gif) text/*
#AddIconByType (IMG,/icons/image2.gif) image/*
#AddIcon /icons/binary.gif .bin .exe
#AddIcon /icons/text.gif .txt
#AddIcon /icons/uuencoded.gif .uu
#AddIcon /icons/hand.right.gif README
#AddIcon /icons/folder.gif ^^DIRECTORY^^
#AddIcon /icons/blank.gif ^^BLANKICON^^
# If no file type matches..
#DefaultIcon /icons/unknown.gif
#AddDescription "GZIP compressed document" .gz
AddDescription "Java class file" .class
AddDescription "Java source file" .java
AddDescription "Java Server Pages source file" .jsp
# Server writes the contents of HeaderName file before the directory listing by adding .html or .txt to the specified name.
# Server writes the contents of ReadmeName after the directory listing.
# The server looks for the-specified-name.html, then the-specified-name.txt
ReadmeName README
HeaderName HEADER
############## END OF NOT-TOO-IMPORTANT ###################


######################################################################
# If the web server's AllowOverride allows LIMIT to be overridden    #
######################################################################
# order, allow from, deny from, allow from env, deny from env

# Controls which domain name or computer host client can get stuff from this server.  
# No space between allow and deny in order (just comma).  allow from all is default
#order allow,deny
#deny from all
#deny from www.yahoo.com
#allow from www.yahoo.com
# The allow from env directive controls access to a directory by the existence
# (or non-existence) of an environment variable. Example: 
# BrowserMatch ^KnockKnock/2.0 let_me_in
# 
#     order deny,allow
#     deny from all
#     allow from env=let_me_in
# 

######################################################################
# If the web server's AllowOverride allows OPTIONS to be overridden  #
######################################################################
# Options, XBitHack, CheckSpelling, Example - in order of importance

# Options:
# ExecCGI - Execution of CGI scripts is permitted
# FollowSymLinks - Server will follow symbolic links in this directory
# SymLinksIfOwnerMatch - Server follows sym links if target file/dir owned by the same user id as the link
# Includes - Server-side includes are permitted
# IncludesNOEXEC - Server-side includes permitted, #exec and #include of CGI scripts are disabled
# Indexes - Lists directory if no index file is found
# MultiViews - Content negotiated MultiViews are allowed. 
# Note that "MultiViews" must be named *explicitly* --- "Options All" doesn't give it to you.
# This here resets any previous settings
# Options IncludesNOEXEC MultiViews
Options Includes MultiViews
# Or, add/subtract from prior options
#Options +Indexes -Includes
# To disable execution of SSI and CGI in this directory
#Options -Includes -IncludesNOEXEC -ExecCGI

# Checks "user" execute permission on file.  If yes, executes it as SSI.
# Then, no need for special file extension .shtml
XBitHack on

# Matches document(s) if maximum one spelling mistake
# CheckSpelling  on

#Example directive is Apache API related for Apache programmers


######################################################################
# The following do not depend on AllowOverride setting at all        #
# These are either always available or need a loaded module          #
######################################################################
# Generally available:
# Satisfy, ServerSignature, LimitRequestBody
#  ... ,  ... 
#  ... ,  ... 
#  ... ,  ... 

# ForceType, SetHandler, RemoveHandler, AddDefaultCharset
# Optionally installed modules:
# CookieName, Header

# Satisfy any is used to password restrict an area, but to let clients from particular
# addresses as defined in 'allow from' to get in without prompting for a password. Default is "all"
#Satisfy any

# Access control by file name in a directory where .htaccess file is placed:
# The following lines prevent .htaccess files from being viewed by
# Web clients.  Since .htaccess files often contain authorization
# information, access is disallowed for security reasons.  Comment
# these lines out if you want Web visitors to see the contents of
# .htaccess files.  If you change the AccessFileName directive above,
# be sure to make the corresponding changes here.

    order allow,deny
    deny from all


# Can use reg exp  instead of line below.
#
#	order allow,deny
#	allow from all
#

# Optionally add a line containing the server version and virtual host
# name to server-generated pages (error documents, FTP directory listings,
# mod_status and mod_info output etc., but not CGI generated documents).
# Set to "EMail" to also include a mailto: link to the ServerAdmin.
#ServerSignature On
#ServerSignature EMail

# Specify cookie name to be used if CookieTracking is set to on.  Needs mod_usertrack installed.
# I specify this up in FileInfo overriding
# CookieName "woiqatty"

# To control denial-of-service attacks
LimitRequestBody 3000000

# For documents served through this directory, modify headers as follows:
# Can also be set, add.  Mod_header not generally available.
#Header append Author "V. Singla"   
#Header unset Author

################# For Apache Windows version only ######################

# use this to specify whether Apache should search windows registry
# or the #! line of the called script itself for interpreter name and location.
#ScriptInterpreterSource script
# Tries to match the called file's extension in registry (e.g. search registry for .pl or .cgi)
#ScriptInterpreterSource registry


############ END OF .htaccess FILE #############