-
Notifications
You must be signed in to change notification settings - Fork 7
Description
Looking at the htaccess.j2 file and noticed a few issues:
-
The iThemes Security block should be wrapped with a
<IfModule mod_rewrite.c>
condition -
Options -Indexes
can be removed since it's now disabled by default, see 68b9e2f -
This block should be merged into one
<IfModule mod_rewrite.c>
section -
The WordPress rules should be extended to support a Multisite flag.
Currently you have to add the Multisite rules to the site config which means they get added before all the other security checks. They should be the last one, just like the default WP rules.
The rules for Multisite have a few variables which we need to define in the config. If one of them is set the provisioner would add the multisite site rules to the .htaccess file. Note that the multisite rules are a replacement of the default rules, so both versions shouldn't be added, which is currently the case.Pseudo code (which can be improved once we know if this is possible):
# BEGIN WordPress <IfModule mod_rewrite.c> {% if item.value.multisite is defined %} RewriteEngine On RewriteBase / RewriteRule ^index\.php$ - [L] # add a trailing slash to /wp-admin RewriteRule ^{{ item.value.multisite.subdir_match }}wp-admin$ {{ item.value.multisite.subdir_replacement_01 }}wp-admin/ [R=301,L] RewriteCond %{REQUEST_FILENAME} -f [OR] RewriteCond %{REQUEST_FILENAME} -d RewriteRule ^ - [L] RewriteRule ^{{ item.value.multisite.subdir_match }}(wp-(content|admin|includes).*) /{{{ item.value.multisite.subdir_replacement_12 }}} [L] RewriteRule ^{{ item.value.multisite.subdir_match }}(.*\.php)$ /{{ item.value.multisite.subdir_replacement_12 }} [L] RewriteRule . index.php [L] {% else %} RewriteEngine On RewriteBase / RewriteRule ^index\.php$ - [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L] {% endif %} </IfModule> # END WordPress