vb.org Archive

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   vBulletin 4 Articles (https://vborg.vbsupport.ru/forumdisplay.php?f=242)
-   -   Step by Step guide to speed up your VB4 OR VB3 (https://vborg.vbsupport.ru/showthread.php?t=267588)

blackberry 10-11-2013 06:56 PM

Mod Rewrite Friendly URLs doesnt open any thread or forum.. using vbseo + vb4suite

final kaoss 10-11-2013 07:33 PM

Hi, did you insert the proper friendly url rewrite rules from your old htaccess into the new one? I'm using vb4 (minus suite) with vbseo just fine.

final kaoss 10-12-2013 06:06 PM

1 Attachment(s)
Ah I see your problem now. I just double checked and and have mine set to Standard URLs in admin cp with vbseo enabled.

blackberry 10-13-2013 07:41 AM

Quote:

Originally Posted by final kaoss (Post 2452699)
Ah I see your problem now. I just double checked and and have mine set to Standard URLs in admin cp with vbseo enabled.

Ok thats fine i can see the main page,but not able to login @forum .. all the members, i did Disable Content Caching --> Yes

Loading of pages is really slow, profiles and groups aren't opening
"The page isn't redirecting properly" -->http://sachiidosti.com/forum/groups/

final kaoss 10-13-2013 01:19 PM

They're opening fine for me using google chrome & firefox.

Also you have over 400 requests on every page. You might want to trim that down as each request adds to the load time.
http://www.webpagetest.org/result/131010_V4_E9C/

Comparing it to my site, mine only makes 28 requests on every page load and if a user is returning then it's only 18 requests for them. Refer to what I said earlier about cutting back on third party scripts or they will continue to put a burden on your site.

Also it looks like you have alot of active members who may be posting images from third party hosts. This addon can help to localize them & reduce page load time for returning visitors.
https://vborg.vbsupport.ru/showthread.php?t=253309

It looks like if you hosted the images on your domain instead of photobucket you could shave off 71KB... quite a bit.
Also if you scale the images you can save over 480KB... all in all around half a megabyte.
This article can help you with image scaling since you use vbseo https://vborg.vbsupport.ru/showthread.php?t=276910

And finally if you defer the parsing of javascript... as I mentioned in another post, you can save another 190KB or so worth of bandwidth.

Quote:

Originally Posted by http://gtmetrix.com/reports/sachiidosti.com/4yipvsgc
In order to load a page, the browser must parse the contents of all <script> tags, which adds additional time to the page load. By minimizing the amount of JavaScript needed to render the page, and deferring parsing of unneeded JavaScript until it needs to be executed, you can reduce the initial load time of your page.


blackberry 10-13-2013 06:21 PM

Quote:

Originally Posted by final kaoss (Post 2452913)
They're opening fine for me using google chrome & firefox.

Also you have over 400 requests on every page. You might want to trim that down as each request adds to the load time.
http://www.webpagetest.org/result/131010_V4_E9C/

Comparing it to my site, mine only makes 28 requests on every page load and if a user is returning then it's only 18 requests for them. Refer to what I said earlier about cutting back on third party scripts or they will continue to put a burden on your site.

Also it looks like you have alot of active members who may be posting images from third party hosts. This addon can help to localize them & reduce page load time for returning visitors.
https://vborg.vbsupport.ru/showthread.php?t=253309

It looks like if you hosted the images on your domain instead of photobucket you could shave off 71KB... quite a bit.
Also if you scale the images you can save over 480KB... all in all around half a megabyte.
This article can help you with image scaling since you use vbseo https://vborg.vbsupport.ru/showthread.php?t=276910

And finally if you defer the parsing of javascript... as I mentioned in another post, you can save another 190KB or so worth of bandwidth.

its opening because m using the old hta .. no one was able to login so i changed it :mad:

thank you for the tips :up:

final kaoss 10-14-2013 11:53 AM

Good to see that you got your issues fixed. Let me know if you need help with anything else.

final kaoss 11-18-2013 12:22 PM

Update: A bit more security has been added to the .htaccess on the first post. This has been attributed properly to http://bodvoc.com/

Disco_Dave 11-22-2013 01:58 PM

Can this, and the other mods recommended in this article still work with 4.2.2?

Dave

final kaoss 11-22-2013 04:35 PM

Yes, I still use them including the supercharged plugin, (except for the sprite mod) on my vb 4.2.2

Disco_Dave 11-23-2013 10:03 AM

I'll give it another shot, it messes with my style a good bit, and I'm not 100% sure I have the skills to fix it......

final kaoss 11-23-2013 03:20 PM

Turns out that there's quite a few issues with the sprite mod and I've marked it optional as such. Instead of going for that, I use lazy load images, which I've included a link to in the first post.

If you want to pursue getting the sprite mod to work, GL!

mathforum 11-24-2013 04:42 AM

I've tried out lots of things in this thread over the past couple of years and overall it's been really helpful so thank you first of all. :)

After researching and researching it seems like vB biggest problem is loading javascript in a bad way that doesn't allow parallel downloading when going through the html header. I've chatted with you about ways to try to compress the JS files but I'm not confident I can do that correctly. It seems like if there were a good fix for the JS files then it would be available, right?

What I do think is a good idea is using a CDN to load the CSS and JS. Images should go there too but I think the first two file types cause the biggest problems. Now there are lots of options out there for CDNs but I believe it's possible to mimic a CDN by creating a subdomain on one's own site to load from. Is that correct? If so, do you know of anyone doing this for a vB forum?

Here is my gtmetrix report if you are interested. Our load time is horrible according to them but for me it's usually lightning quick to load. I feel like Google Adsense will add one 1-2 seconds to a page sometimes but the real content is already loaded by then.

Max Taxable 11-24-2013 04:53 AM

Quote:

Originally Posted by mathforum (Post 2463290)
I believe it's possible to mimic a CDN by creating a subdomain on one's own site to load from. Is that correct? If so, do you know of anyone doing this for a vB forum?

I have seen that done and it does not help speed at all, it's simply not a Content Delivery Network - in the end it's just another folder on your same host. :)
Quote:

Here is my gtmetrix report if you are interested. Our load time is horrible according to them but for me it's usually lightning quick to load. I feel like Google Adsense will add one 1-2 seconds to a page sometimes but the real content is already loaded by then.
I use ONLY the Patrick Meehan webpagetest site (Meehan is Google's Tech head.) They're not selling ANYTHING there... Most sites that give you a bad report, are. Webpagetest is ALL about education.

Here's a test I just did on you, the pageload is not too shabby for a site loading 111 requests.... This was with a IE10 browser on cable internet, Dulles VA. You can choose any browser, dozens of locations and connection types.

http://www.webpagetest.org/result/131124_WS_5SN/

As you can see by clicking on the waterfall view, your js is cascading parallel, just fine and dandy for IE10.

mathforum 11-24-2013 05:12 AM

Thank you again for your comments :)

I've used WebPagetest before many times in addition to some others. The output of it isn't as clear as to what steps can be made to improve issues like on gtmetrix or YSlow. Nevertheless, the main issues are pretty clear to me concerning vB - loading static content better.

It's interesting you say that the JS files are actually loading in parallel, which is something I thought was a big problem for vB. I also have a handful of other JS code/files related to Tapatalk and Mathjax. In terms of just moving all JS, CSS and images to a CDN without any further tweaking - how much of an improvement do you think this could make? I really wish we had some "before and after" data to look at.

Trying to make real changes to my site that result in better speeds is something that has been like a theoretical marathon of reading about different strategies but not knowing how to do them. I would like to try to implement something at last, but need guidance where to start.

Max Taxable 11-24-2013 05:20 AM

Quote:

Originally Posted by mathforum (Post 2463294)
Thank you again for your comments :)

I've used WebPagetest before many times in addition to some others. The output of it isn't as clear as to what steps can be made to improve issues like on gtmetrix or YSlow. Nevertheless, the main issues are pretty clear to me concerning vB - loading static content better.

It's interesting you say that the JS files are actually loading in parallel, which is something I thought was a big problem for vB. I also have a handful of other JS code/files related to Tapatalk and Mathjax. In terms of just moving all JS, CSS and images to a CDN without any further tweaking - how much of an improvement do you think this could make? I really wish we had some "before and after" data to look at.

Trying to make real changes to my site that result in better speeds is something that has been like a theoretical marathon of reading about different strategies but not knowing how to do them. I would like to try to implement something at last, but need guidance where to start.

Keeping consistent with your testing is key to seeing before/after results. These Meehan tests stay up - you can bookmark them. You can repeat them with exact parameters. Compare results of changes. Over time. Like I said that is all I use - keeping the test variables and conditions to a minimum.

You'll see when you click on the waterfall view of your test, what I am talking about re: your js files cascading parallel nicely. Then run the test using a IE6 or 7 or 8 browser and you will see them, NOT do that. Older browsers just can't load js parallel.

There's all kinds of tutorials based on your specific tests, at Meehan. There's also a message board community there not unlike this one, with many knowledgeable volunteer helpers like alot of the folks here at vB dot org. :D

mathforum 11-24-2013 06:00 AM

The thing is we are all using the same base code for vB 4.x.x and most of the techniques for improving performance should be applicable to everyone else I would think. I'm not against doing tests and gathering data, in fact I enjoy that sort of thing, but I don't have an idea of where to start.

I just checked out http://www.video-game-chat.com/forum/ which is the website of the author of this article and I'm thrilled to see a super fast loading time and a great Webpagetest report. I wonder why he has so little files to load compared to my site?

Ok I'll start with double checking my .htaccess file. vbsupercharged is EOL so can't use that and the CSS Sprites program has issues according to this thread. That pretty much leaves using a CDN and Lazy load images right?

Max Taxable 11-24-2013 06:34 AM

Quote:

Originally Posted by mathforum (Post 2463297)

I just checked out http://www.video-game-chat.com/forum/ which is the website of the author of this article and I'm thrilled to see a super fast loading time and a great Webpagetest report. I wonder why he has so little files to load compared to my site?

Because like me, he is not running any adverts. He also like me, has a very simple skin design that doesn't have a million large kb images associated with it. I'm only faster than him because I run vB 3.8.:D

Every image, every advert, and alot of the mods you might install, are going to have their calls in the script. It can add up really quickly and bog your site down - it's one of the reasons your first byte time is relatively slow too. You have a heavy web page. Over 1,000 kb loaded there.

Look at the waterfall in detail, look at what all of your 111 calls are. Default vBulletin out of the box only has 30 calls or so....

http://www.webpagetest.org/result/13...5SN/1/details/

At the bottom of the waterfall, click on "View all images" to get details on all your image sizes, whether they are compressed or not, and so on.


By contrast, he's got TINY images that he sizes in the script, they don't load very many kb on a browser.

http://www.webpagetest.org/pageimage...run=1&cached=0



Here's me. You don't need a CDN to be greasy fast.

http://www.webpagetest.org/result/131124_X8_7E5/

mathforum 11-24-2013 08:36 AM

Very interesting to see the images displayed like that! Thank you for showing me this option.

You make a good point. My custom design is heavy with pictures and we do have a decent amount of mods running that might not be optimized for speed. The number of requests is just too high I think. I don't know how to do this, but combining images lots of the tinier images into a sprite would be helpful. Luckily on the homepage there's only one modification that adds a lot of js and requests, but I can't get rid of it so that is what it is. Google ads are also being a bit annoying with the number of files and images running each time. :mad:

Speaking of sprites, it seems the mod referenced in this article might still work for vB 4.2.0, the version we have. I'm worried about all of our custom images not working with the code but I'll give it a shot. If you have any advice on this I am all ears, otherwise I'll do my best to use the directions plus support thread.

This has been a good discussion because I'm now seeing more details than I was before and in a more useful way. Maybe my misunderstandings can be useful to others who also don't know how apply the advice here.

final kaoss 11-24-2013 01:51 PM

Alot of images can slow a site down alot. Using Lazy Load, you can help reduce the load for guests... idk about search bots. As it loads images as the user scrolls down, meaning they can load many of the other static elements first. As for optimizing images, there's a few on the OP that don't reduce the quality, just the kb of the images; aka lossless image optimization.

As for using mods that you feel aren't optimized, for those that use js, you can run them through a javascript compressor online like this one.

You can give the sprite mod a chance if you want but it gives users hell just to get the thing running and some people can't get it to run at all! Which is why I don't recommend it.

I think the last thing you need to do is play around with deferring js... but don't go crazy with it, some core js just won't work if you try to defer it and cause you issues. It's been a while since I dabbled with it, so if you can report your findings on that here... it would help alot!

The easiest way to remember to do this is to insert it in the first script tag before it closes like so.

Code:

<script src="some_javascript.js" defer>

Max Taxable 11-24-2013 04:39 PM

Quote:

Originally Posted by mathforum (Post 2463312)
Luckily on the homepage there's only one modification that adds a lot of js and requests, but I can't get rid of it so that is what it is.

You might even make a decision like I did, <if> conditionals which hide certain mods, products and/or plugins from the unregistered/not logged in usergroup. Really works wonders. In vB3 it's <if condition: $show member> or some such. This conditional would be added to whatever template the Mod is called in. Your membership still gets all the fancy toys and doodads - once they are logged in. Ask yourself what benefit the Mod has for the visitor, for SEO, spiders and so on. Do those perceived benefits outweigh the cost in added load time, amount of extra requests, and bytes delivered? Do the Mods help or hurt the SEO? And so forth.

The most important thing to remember about page load speed is not to get too bogged down in it. Make a strategic decision about how much work you want to do vs. the perceived benefits. For example, there is still alot I could do to make my site even faster than it is, but I reached the point of diminishing returns pretty quickly and still have decent results. You just have to set attainable goals, do the easier stuff first, then re-evaluate as you go along.

Like alot of stuff of webmastering, it's about personal preferences.

final kaoss 01-03-2014 04:40 PM

Yep, my guide covers pretty much all you need to do. There are other things you can pursue if you wish but really, it's up to you to put in the time to try to go after the other stuff, which really won't help all that much in terms of performance.

goxy63 01-17-2014 09:44 AM

Hi

I am having some weird problem with "404 Not Found nginx"

Was thinking to ask is it somehow related with this code here, I guess it might be but I am not that good with all this

In fact I think its somehow related with ads which I host from http://yllix.com/
Problem always occurs in place where ads are presented, but its always random, for some users problem is there and for some of them like me its not...its weird

those 404 nginx and these
http://lp.sharelive.net/?sysid=406&a...4xNigBMJ-N5JYF

any suggestions?

Some users when open my forums they got this issue at once

Code:

http://www.zaliv.co/forum.php

Dave 01-17-2014 10:58 AM

Quote:

Originally Posted by goxy63 (Post 2474868)
Hi

I am having some weird problem with "404 Not Found nginx"

Was thinking to ask is it somehow related with this code here, I guess it might be but I am not that good with all this

In fact I think its somehow related with ads which I host from http://yllix.com/
Problem always occurs in place where ads are presented, but its always random, for some users problem is there and for some of them like me its not...its weird

those 404 nginx and these
http://lp.sharelive.net/?sysid=406&a...4xNigBMJ-N5JYF

any suggestions?

Some users when open my forums they got this issue at once

Code:

http://www.zaliv.co/forum.php

Most likely caused by the mod rewrite friendly URL's, this is for Apache and not nginx.

final kaoss 01-19-2014 02:08 AM

Updated the first post to include the jpegmini tool!

goxy63 01-20-2014 02:07 PM

Quote:

Originally Posted by final kaoss (Post 2475297)
Updated the first post to include the jpegmini tool!

new code was producing me a bug, when someone send you pm... notification appears again even after you read it....changed back to old code...

final kaoss 01-20-2014 07:01 PM

Sounds to me like you missed this step.
https://vborg.vbsupport.ru/showpost....44&postcount=3
Also like others have stated, the htaccess is NOT for nginx.

Quote:

Originally Posted by goxy63 (Post 2475543)
new code was producing me a bug, when someone send you pm... notification appears again even after you read it....changed back to old code...


ozzy47 03-06-2014 02:20 AM

@final kaoss, if I PM you my .htaccess, could you take a look at it, and clean it up a bit? It is working pretty dang good, but I think it looks like a mess, and you may see something that may need tweaking.

final kaoss 03-06-2014 01:52 PM

Go ahead I can have a look at it.

tbworld 03-06-2014 03:15 PM

Quote:

I think it looks like a mess
People should always view my messes as 'art in progress'. :)

ozzy47 03-09-2014 11:46 PM

Here is my latest results for my site, pretty frigging good for vB4, http://www.webpagetest.org/result/140309_D0_RWZ/

final kaoss 03-10-2014 01:25 AM

Now if only vb.org did some of the changes :)
http://www.webpagetest.org/result/140310_RR_1G9/

ozzy47 03-10-2014 01:26 AM

Yeah it could use some tweaking, but it is vB3, so it loads quickly.

Max Taxable 03-10-2014 02:47 AM

Quote:

Originally Posted by final kaoss (Post 2486135)
Now if only vb.org did some of the changes :)
http://www.webpagetest.org/result/140310_RR_1G9/

They have some images that need to be optimized, and some they really can't control because they are avatars.

But when we test their home page, we see result without avatars and the images they need to optimize are listed: http://www.webpagetest.org/result/14...ompress_images

But it only winds up being a savings of 4.8kb, hardly seems worth the effort just to get a A grade on that..

However they're not caching static assets very well.
HTML Code:

Leverage browser caching of static assets: 3/100

FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/cstyle/redstyle.gif
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/cstyle/whitestyle.gif
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/cstyle/greenstyle.gif
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/cstyle/bluestyle.gif
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/cstyle/purplestyle.gif
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/misc/stats.gif
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/misc/birthday.gif
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/misc/menu_open.gif
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/cstyle/blue/header.jpg
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/cstyle/blue/tcat.jpg
FAILED - (No max-age or expires) - http://www.vbulletin.org/favicon.ico
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/cstyle/bottomshade.gif
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/cstyle/blue/headbg.jpg
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/cstyle/blue/vheader.jpg
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/cstyle/button2.gif
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/misc/whos_online.gif
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/cstyle/blue/buttons/collapse_thead.gif
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/clientscript/vbulletin_menu.js?v=3612
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/cstyle/blue/vblogo.gif
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/clientscript/vborg_miscactions.js?v=3612
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/clientscript/blue.css
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/clientscript/vbulletin_global.js?v=3612
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/clientscript/vbulletin_md5.js?v=3612
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/cstyle/blue/bodybkgd950px.jpg
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/cstyle/blue/buttons/lastpost.gif
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/clientscript/vbulletin_read_marker.js?v=3612
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/cstyle/blue/statusicon/subforum_old.gif
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/cstyle/blue/statusicon/forum_old.gif
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/misc/navbits_start.gif
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru/images/cstyle/blue/buttons/collapse_tcat.gif
FAILED - (No max-age or expires) - https://vborg.vbsupport.ru

And that's a very easy .htaccess fix.

But with only 90 total KB loaded and only 34 requests, it's not nearly as bad as the grades might seem to make it look.

It's about 15 minutes work to fix everything here and get straight A grades.

final kaoss 03-10-2014 11:54 AM

It wouldn't even take 15 minutes to apply the caching. Maybe 1-3 at most depending on who's modifying it :) but yeah that is one of the big issues is not having their static elements being cached.

bzcomputers 03-22-2014 06:05 AM

I noticed a couple issues at the bottom of the last two sections in the suggested .htaccess file:

Code:

# proc/self/environ? no way!
RewriteCond %{QUERY_STRING} proc/self/environ [OR]
# Block out any script trying to set a mosConfig value through the URL
RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]
# Block out any script trying to base64_encode crap to send via URL
RewriteCond %{QUERY_STRING} base64_encode.*(.*) [OR]
# Block out any script that includes a <script> tag in URL
RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR]
# Block out any script trying to set a PHP GLOBALS variable via URL
RewriteCond %{QUERY_STRING} GLOBALS(=|[|\%[0-9A-Z]{0,2}) [OR]
# Block out any script trying to modify a _REQUEST variable via URL
RewriteCond %{QUERY_STRING} _REQUEST(=|[|\%[0-9A-Z]{0,2})
*** ADD RULE HERE***
##
##&nbsp; Commented version of Rewrite rules attributed to Ronald van den Heetkamp
##&nbsp; Comments by http://bodvoc.com
#
# Prevent use of specified methods in HTTP Request
RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK) [NC,OR]
# Block out use of illegal or unsafe characters in the HTTP Request
RewriteCond %{THE_REQUEST} ^.*(\\r|\\n|%0A|%0D).* [NC,OR]
# Block out use of illegal or unsafe characters in the Referer Variable of the HTTP Request
RewriteCond %{HTTP_REFERER} ^(.*)(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR]
# Block out use of illegal or unsafe characters in any cookie associated with the HTTP Request
RewriteCond %{HTTP_COOKIE} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR]
# Block out use of illegal characters in URI or use of malformed URI
RewriteCond %{REQUEST_URI} ^/(,|;|:|<|>|">|"<|/|\\\.\.\\).{0,9999}.* [NC,OR]
# NOTE - disable this rule if your site is integrated with Payment Gateways such as PayPal
# Block out  use of empty User Agent Strings
RewriteCond %{HTTP_USER_AGENT} ^$ [OR]
# Block out  use of User Agent Strings beginning with java, curl or wget
RewriteCond %{HTTP_USER_AGENT} ^(java|curl|wget).* [NC,OR]
# Block out  use of User Agent Strings containing specific robot (crawler) identifiers
RewriteCond %{HTTP_USER_AGENT} ^.*(winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner).* [NC,OR]
# Block out  use of User Agent Strings containing references to specific crawler libraries
RewriteCond %{HTTP_USER_AGENT} ^.*(libwww-perl|curl|wget|python|nikto|scan).* [NC,OR]
# Block out  use of illegal or unsafe characters in the User Agent variable
RewriteCond %{HTTP_USER_AGENT} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR]
# Measures to block out  SQL injection attacks
RewriteCond %{QUERY_STRING} ^.*(;|<|>|'|"|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|cast|set|declare|drop|update|md5|benchmark).* [NC,OR]
# Block out  reference to localhost/loopback/127.0.0.1 in the Query String
RewriteCond %{QUERY_STRING} ^.*(localhost|loopback|127\.0\.0\.1).* [NC,OR]
# Block out  use of illegal or unsafe characters in the Query String variable
RewriteCond %{QUERY_STRING} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC]
*** ADD RULE HERE***
#
## End of commented Rewrite directives
#

The problem with this is you have all these rewrite conditions then at the end you don't have a rewrite rule. You need to add something like this:

Code:

# Send all blocked requests to homepage with 403 Forbidden error!
RewriteRule ^(.*)$ index.php [F,L]

In the two spots where I placed *** ADD RULE HERE*** in the code block above.

-------------------------------------------------------------------------------------------

...also suggest a slight change to this line:
Code:

# Block out any script trying to base64_encode crap to send via URL
RewriteCond %{QUERY_STRING} base64_encode.*(.*) [OR]

to this:
Code:

# Block out any script trying to base64_encode or base64_decode data via URL
RewriteCond %{QUERY_STRING} base64_(en|de)code[^(]*\([^)]*\) [OR]


Disco_Dave 03-22-2014 09:57 AM

Quote:

Originally Posted by bzcomputers (Post 2488879)
I noticed a couple issues at the bottom of the last two sections in the suggested .htaccess file:

Code:

# proc/self/environ? no way!
RewriteCond %{QUERY_STRING} proc/self/environ [OR]
# Block out any script trying to set a mosConfig value through the URL
RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]
# Block out any script trying to base64_encode crap to send via URL
RewriteCond %{QUERY_STRING} base64_encode.*(.*) [OR]
# Block out any script that includes a <script> tag in URL
RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR]
# Block out any script trying to set a PHP GLOBALS variable via URL
RewriteCond %{QUERY_STRING} GLOBALS(=|[|\%[0-9A-Z]{0,2}) [OR]
# Block out any script trying to modify a _REQUEST variable via URL
RewriteCond %{QUERY_STRING} _REQUEST(=|[|\%[0-9A-Z]{0,2})
*** ADD RULE HERE***
##
##&nbsp; Commented version of Rewrite rules attributed to Ronald van den Heetkamp
##&nbsp; Comments by http://bodvoc.com
#
# Prevent use of specified methods in HTTP Request
RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK) [NC,OR]
# Block out use of illegal or unsafe characters in the HTTP Request
RewriteCond %{THE_REQUEST} ^.*(\\r|\\n|%0A|%0D).* [NC,OR]
# Block out use of illegal or unsafe characters in the Referer Variable of the HTTP Request
RewriteCond %{HTTP_REFERER} ^(.*)(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR]
# Block out use of illegal or unsafe characters in any cookie associated with the HTTP Request
RewriteCond %{HTTP_COOKIE} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR]
# Block out use of illegal characters in URI or use of malformed URI
RewriteCond %{REQUEST_URI} ^/(,|;|:|<|>|">|"<|/|\\\.\.\\).{0,9999}.* [NC,OR]
# NOTE - disable this rule if your site is integrated with Payment Gateways such as PayPal
# Block out  use of empty User Agent Strings
RewriteCond %{HTTP_USER_AGENT} ^$ [OR]
# Block out  use of User Agent Strings beginning with java, curl or wget
RewriteCond %{HTTP_USER_AGENT} ^(java|curl|wget).* [NC,OR]
# Block out  use of User Agent Strings containing specific robot (crawler) identifiers
RewriteCond %{HTTP_USER_AGENT} ^.*(winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner).* [NC,OR]
# Block out  use of User Agent Strings containing references to specific crawler libraries
RewriteCond %{HTTP_USER_AGENT} ^.*(libwww-perl|curl|wget|python|nikto|scan).* [NC,OR]
# Block out  use of illegal or unsafe characters in the User Agent variable
RewriteCond %{HTTP_USER_AGENT} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR]
# Measures to block out  SQL injection attacks
RewriteCond %{QUERY_STRING} ^.*(;|<|>|'|"|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|cast|set|declare|drop|update|md5|benchmark).* [NC,OR]
# Block out  reference to localhost/loopback/127.0.0.1 in the Query String
RewriteCond %{QUERY_STRING} ^.*(localhost|loopback|127\.0\.0\.1).* [NC,OR]
# Block out  use of illegal or unsafe characters in the Query String variable
RewriteCond %{QUERY_STRING} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC]
*** ADD RULE HERE***
#
## End of commented Rewrite directives
#

The problem with this is you have all these rewrite conditions then at the end you don't have a rewrite rule. You need to add something like this:

Code:

# Send all blocked requests to homepage with 403 Forbidden error!
RewriteRule ^(.*)$ index.php [F,L]

In the two spots where I placed *** ADD RULE HERE*** in the code block above.

-------------------------------------------------------------------------------------------

...also suggest a slight change to this line:
Code:

# Block out any script trying to base64_encode crap to send via URL
RewriteCond %{QUERY_STRING} base64_encode.*(.*) [OR]

to this:
Code:

# Block out any script trying to base64_encode or base64_decode data via URL
RewriteCond %{QUERY_STRING} base64_(en|de)code[^(]*\([^)]*\) [OR]



I use this one also, I wonder if there's something in mine that stops my dbseocp panel taking me back to the ACP.....I need one you guys to may be run your eyes over mine :)

bzcomputers 03-22-2014 04:39 PM

Quote:

Originally Posted by Disco_Dave (Post 2488899)
I use this one also, I wonder if there's something in mine that stops my dbseocp panel taking me back to the ACP.....I need one you guys to may be run your eyes over mine :)

PM me a copy and I'll look at it.

tpearl5 03-31-2014 07:00 PM

remember, you really have no reason to use mod_deflate if your server is already set to use gzip.

final kaoss 03-31-2014 08:27 PM

You'll be just fine using mod_deflate. Just turn off vbulletin's gzip function otherwise, you'll be increasing load for no reason plus I don't believe vbulletins gzip feature covers everything.

Quote:

The mod_deflate module is similar to mod_gzip, but usable only with Apache v2. Early versions of mod_deflate provided lesser amount of compression than mod_gzip.[2] Starting with Apache 2.0.45, the compression level of mod_deflate is configurable using the DeflateCompressionLevel directive, so this difference disappeared.
A mod_gz module was independently developed by Ian Holsman. This module implements a gzip compression filter for Apache 2.0, providing similar functionality to mod_gzip. One important difference between the two modules is that mod_gzip includes its own gzip implementation, whereas mod_gz relies on an external zlib library.


All times are GMT. The time now is 11:38 AM.

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.03330 seconds
  • Memory Usage 1,923KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (11)bbcode_code_printable
  • (1)bbcode_html_printable
  • (16)bbcode_quote_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (3)pagenav_pagelink
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (40)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 

Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • pagenav_page
  • pagenav_complete
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete