Performance and security
Permalink 1 user found helpful
As Concrete5 gains popularity I can see its performance and security coming under closer scrutiny.
I recently ran some test sites thru GTMetrix [http://gtmetrix.com/] which can be a sobering experience. Even if you take issue with the stats you can't take issue with the relative comparison after tweaking your own site and re-running it.
I recently did this with C5 5.6.1 with all the caching turned on and got a rating of 34% for speed. That hurt - especially on a dedicated server - so I utilised some htaccess rules from the Joomla Community that I have seen work pretty well.
THe rules are complicated for beginners in htaccess and let me state these are only tested with 5.6.1 on linux and apache 2 [some rules wont work on apache 1.x]
Anyway here are the contents of my htaccess file that took my relative speed from 34% score to 64%. There is still some more tweaking to do to the site to squeeze more out of it but this is a boost in the right direction.
ref:http://docs.joomla.org/Htaccess_examples_(security)
I recently ran some test sites thru GTMetrix [http://gtmetrix.com/] which can be a sobering experience. Even if you take issue with the stats you can't take issue with the relative comparison after tweaking your own site and re-running it.
I recently did this with C5 5.6.1 with all the caching turned on and got a rating of 34% for speed. That hurt - especially on a dedicated server - so I utilised some htaccess rules from the Joomla Community that I have seen work pretty well.
THe rules are complicated for beginners in htaccess and let me state these are only tested with 5.6.1 on linux and apache 2 [some rules wont work on apache 1.x]
Anyway here are the contents of my htaccess file that took my relative speed from 34% score to 64%. There is still some more tweaking to do to the site to squeeze more out of it but this is a boost in the right direction.
ref:http://docs.joomla.org/Htaccess_examples_(security)
########## Begin - Automatic compression of resources # Compress text, html, javascript, css, xml, kudos to Komra.de # May kill access to your site for old versions of Internet Explorer # The server needs to be compiled with mod_deflate otherwise it will send HTTP 500 Error. # mod_deflate is not available on Apache 1.x series. Can only be used with Apache 2.x server. # AddOutputFilterByType is now deprecated by Apache. Use mod_filter in the future. <ifModule mod_deflate.c> AddOutputFilterByType DEFLATE text/html text/xml text/css text/plain AddOutputFilterByType DEFLATE image/svg+xml application/xhtml+xml application/xml AddOutputFilterByType DEFLATE application/rdf+xml application/rss+xml application/atom+xml AddOutputFilterByType DEFLATE text/javascript application/javascript application/x-javascript application/json AddOutputFilterByType DEFLATE application/x-font-ttf application/x-font-otf AddOutputFilterByType DEFLATE font/truetype font/opentype </ifModule> ########## Begin - Optimal default expiration time
Viewing 15 lines of 91 lines. View entire code block.
Late night post :)
Yes there is some more....
Again from the same source as above, there are a few htaccess rules targeted at sql / file injections and anti spam...
Yes there is some more....
Again from the same source as above, there are a few htaccess rules targeted at sql / file injections and anti spam...
########## Begin - Rewrite rules to block out some common exploits ## If you experience problems on your site block out the operations listed below ## This attempts to block the most common type of exploit `attempts` to Joomla! # # If the request query string contains /proc/self/environ (by SigSiu.net) RewriteCond %{QUERY_STRING} proc/self/environ [OR] # Block out any script trying to set a mosConfig value through the URL # (these attacks wouldn't work w/out Joomla! 1.5's Legacy Mode plugin) RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR] # Block out any script trying to base64_encode or base64_decode data within the URL RewriteCond %{QUERY_STRING} base64_(en|de)code[^(]*\([^)]*\) [OR] ## IMPORTANT: If the above line throws an HTTP 500 error, replace it with these 2 lines: # RewriteCond %{QUERY_STRING} base64_encode\(.*\) [OR] # RewriteCond %{QUERY_STRING} base64_decode\(.*\) [OR] # Block out any script that includes a <script> tag in URL
Viewing 15 lines of 61 lines. View entire code block.
Should say / remind anyone using this that it is an example that can be added upon as well as edited, and more importantly, it might interfere with some legitimate requests, though I havent found it to do so yet......
Surprised these ones aren't in there
RewriteCond %{QUERY_STRING} allow_url_include [NC,OR] RewriteCond %{QUERY_STRING} auto_prepend_file [NC] RewriteRule ^.*$ - [F,L]
I'm a bit confused, you htaccess adds a lot to improve performance (gzipping, expiry dates) but I don't see anything helping with security. Wasn't that part of the topic?