Search code examples
php.htaccesscpanelwebsecurity

Suspicious .htaccess file in every directory and sub-directory


I found a suspicious .htaccess in every folder and sub-folder in cPanel. Besides an 'index.php' file in a sub-directory was renamed to 'index.php_' and LAST MODIFIED was showing 'Jul 25, 2021 3:29 PM' in every file and folder. Content in .htaccess file is as follows:

<FilesMatch ".(py|exe|phtml|php|PhP|php5|suspected)$">

Order Allow,Deny

Deny from all

</FilesMatch>

I also have SSL installed, but browser was saying "Suspicious Site". Is it an Attack? How can I prevent this to happen? Hosting company's support is not Helpful.


Solution

  • it is a file that is being read by apache and controls access. You can redirect, forbid and allow access to certain files, links, modify header information and much more (depending what is allowed by apache)

    The rule you specified disallows to access any file that has py, exe, phtml, php, PhP, php5, suspected extensions.

    The rule is bad written but not suspicious at all

    Are you using Chrome? It might be that the server your site is hosted on was spreading file that has been identified as virus or had phishing/scam activity going on. Was your website hacked by any chance?

    If it was then clean your website, fix the security vulnerabilities and apply a review on https://developers.google.com/web/fundamentals/security/hacked/request_review