.htaccess Permission

Tom · 2026-07-27T18:44:20+00:00

Ich beschäftige mich seit dem Wochenende mit HTProtect und bin begeistert. Ein super Tool! Ich habe mittlerweile meine eigene zentrale .htaccess Datei in die von HTProtect integriert. Dabei ist mir aufgefallen, dass HTProtect seiner .htaccess die Rechte 0444 zuweist, während ich vorher 0604 vergeben hatte. Dies führt nun dazu, dass ich von der Erweiterung Brute Force Stop, die selber anbietet Informationen in die .htaccess zu schreiben, eine Warnung erhalte, dass die .htaccess nicht schreibbar ist. Deshalb folgende Fragen: Ist es wichtig, der .htaccess keinerlei Schreibrechte zu geben? Macht es Sinn, die Rechte per Option für den Administrator einstellbar zu machen? Danke & Gruß Tom

Tom

I've been working with HTProtect since the weekend and I'm really impressed. Such a great tool!
I've now integrated my own central .htaccess file into the one from HTProtect. I noticed that HTProtect sets the permissions of its .htaccess to 0444, while I had previously set mine to 0604. This is causing a warning from the Brute Force Stop extension, which also offers to write info into the .htaccess, saying that the file isn't writable. So, I have a couple of questions:

Is it really important to give the .htaccess no write permissions at all?
Would it make sense to have an option to let the admin set the permissions?

Thanks & cheers
Tom

Pascal

Hi Tom,
HTProtect is designed to have full and exclusive control over the .htaccess file. You’re not supposed to make manual changes to it (hence chmod 444).
If you want Brute Force Stop to be written in, you can flip the last switch in the advanced shield settings - "manage .htaccess externally" - then HTProtect won’t touch the .htaccess anymore.
Personally, I’m not a big fan of IP blocking against brute force on the Joomla side. Usually, hosting/server-side protections (like Fail2Ban) are already in place, and blocking constantly changing IPs only helps so much. Long, complex passwords make way more sense.

Tom

Thanks for the explanation, Pascal.
That makes sense and is understandable.
Unfortunately, it seems my host doesn’t offer Fail2Ban. At least, I don’t see any effect when I check the logs. So, to fight the login spammers, I had installed the Brute Force Stop extension back then. But sadly, it’s not as effective as hoped because it doesn’t deter spammers permanently without manual intervention.
Cheers
Tom