|
Article:
Defend Your Thank You Folders From URL Guessers by: Robert Plank If you sell downloadable products, you're going to have a thank you page (a URL where the buyer is redirected after a sale). With just a couple lines of HTACCESS code you can make that folder airtight. You shouldn't be putting a buyer through a mandatory signup process to download the product. They already paid, just give them the file right away and offer a chance to opt-in for updates later. Otherwise you'll be getting lots of support e-mails from people asking where the product is they just paid for. It's always smart to name your thank you page something with a number -- a name like postorder735.html or thank-you-9987.html will do. You just want to make this impossible to guess. When it's possible I like to separate the sales page from the download, so I stash them in a folder called something like 'download' or 'order.' Problem: If you have these separate folders, these URL guessers can see the contents of them. The obvious solution is to put an index.html in the folder, which keeps its contents from being listed... but what if you have, say, 25 of these folders? Do you need 25 index.html files? No, and that's where HTACCESS comes in. Open up a new text file in Notepad and put this text in exactly: Options -Indexes Then save the file as: .htaccess (WITH that dot in front) Upload it to the root of your web site. Now, if you try to view the contents of a folder that's missing an index.html file, your browser will show a '403 Forbidden' error. Don't worry, this won't block out all files. It will simply keep a guesser from viewing a list of what files are in a given folder. If you don't want to see that ugly generic Forbidden page, you can supply your own by adding this line to that .htaccess file of yours: ErrorDocument 403 /sorry.html Now you can put your message into a HTML file (maybe it could be a link to the main page of your site), put it into a file named sorry.html and upload it. Now you'll have a friendly notice that says anything you want. One last bonus tip for you. If your forbidden message is extremely short, you don't even need to create a separate HTML document. If it's possible for your message to fit all on one line you can remove that ErrorDocument line above from your .htaccess file and put in something like this: ErrorDocument 403 'Sorry... I'm aware that there is a starting quote and no ending quote. That's just how you have to type it. If you put in a quote at the end there it would show up in your HTML document. I know it looks funny, but it works. Remember that 'Sorry...' text is HTML so you could put in line breaks, links, bold tags, H'1
|
