Misc File Skip/Bypass Rule

May I know what’s the purpose of whitelisting our own domain, as since it is our own domain, why it needs to be manually whitelisted?

Secondly, is the following the correct input to whitelist my own domain?

# Example: Whitelist additional website domains: RewriteCond %{HTTP_REFERER} ^.*(YourWebsite.com|AnotherWebsite.com).*
RewriteCond %{HTTP_REFERER} ^.*mydomain.com.*
RewriteRule . - [S=1]

Hi BPS,

Very sorry, I can understand this:

That section of BPS htaccess code protects against the old Tim Thumb hack and more importantly RFI hacking attempts > https://www.owasp.org/index.php/Testing_for_Remote_File_Inclusion

But not this:

The code works like this > If the referring domain is your own domain then skip [S-1] the BPS Query String section of code, which contains RFI security rules that will block RFI hacking attempts against your website. Since Requests using your own website domain are Local and not Remote Requests then the Skip Rule allows simulated RFI hacking attempts: http://your-website-domain.com/?file=http://your-website-domain.com/some-safe-file-on-your-website-domain.php. RFI stands for Remote File Inclusion.

Do you mean that With the following block of codes, mydomain.com is 1) protected from external RFI hacking attempts and 2) whitelisted from internal RFI hacking attempts (RFI hacking attempts sent out from mydomain.com)?

# Example: Whitelist additional website domains: RewriteCond %{HTTP_REFERER} ^.*(YourWebsite.com|AnotherWebsite.com).*
RewriteCond %{HTTP_REFERER} ^.*mydomain.com.*
RewriteRule . - [S=1]

Please advise, thank you!

Understood 🙂

Thank you for the great invention and kind response!