این کد بسیار کاربردی هست توصیه میکنم کسانی که mybb استفاده میکنن از دست ندن کاملا تست شده و عملی هست درصد نفوذ رو کمتر میکنه

این کد رو در htaccess هاستتون دخیره کنید

کد PHP:
#public by : www.parsicoders.com (amin mansouri) 
#High Security Mybb ;-) (anti sql injection , anti xss ,anti lfi ,and....) 
Options -Indexes 
Options 
-MultiViews 

IndexIgnore 


# Protect the config.php file 
<files config.php
Order deny,allow 
deny from all 
</files

<
Files "^\.ht"
Order allow,deny 
Allow from all 
</Files



<
IfModule mod_security.c
SecFilterEngine Off 
SecFilterScanPOST Off 
</IfModule

<
IfModule mod_rewrite.c
RewriteEngine on 
RewriteBase 

RewriteCond %{THE_REQUEST} !^[A-Z]{3,9} [a-zA-Z0-9.+_/-?=&]+ HTTP/ [NC
RewriteRule .* - [F,NS,L
RewriteCond %{QUERY_STRING} (|%3E) [NC,OR] 
RewriteCond %{QUERY_STRING} ^.*=(ht)|(f)|(sf)+(tp)+(://|s://)+.*(\?\?)+ [NC,OR] 
RewriteCond %{QUERY_STRING} !redirect_to [NC
RewriteCond %{QUERY_STRING} !continue [NC
RewriteCond %{QUERY_STRING} .*=http.*(:|%3A) [NC,OR] 
RewriteCond %{QUERY_STRING} .*=https.*(:|%3A) [NC,OR] 
RewriteCond %{QUERY_STRING} .*=ftp.*(:|%3A) [NC,OR] 
RewriteCond %{QUERY_STRING} .*=sftp.*(:|%3A) [NC,OR] 
RewriteCond %{QUERY_STRING} .*jos_.* [NC,OR] 
RewriteCond %{QUERY_STRING} .*users+where+gid.* [NC,OR] 
RewriteCond %{QUERY_STRING} .*proc/self/environ.* [NC,OR] 
RewriteCond %{QUERY_STRING} .*union+select.* [NC,OR] 
RewriteCond %{QUERY_STRING} .*perl+.* [NC,OR] 
RewriteCond %{QUERY_STRING} .*curl+.* [NC,OR] 
RewriteCond %{QUERY_STRING} .*SQL.* [NC,OR] 
RewriteCond %{QUERY_STRINGGLOBALS(=|[|%[0-9A-Z]{0,2}) [OR] 
RewriteCond %{QUERY_STRING_REQUEST(=|[|%[0-9A-Z]{0,2}) 
RewriteCond %{REQUEST_METHOD}  ^(HEAD|TRACE|DELETE|TRACK) [NC,OR] 
RewriteCond %{THE_REQUEST}    ^.*(r|n|%0A|%0D).* [NC,OR] 
RewriteCond %{HTTP_REFERER}    ^(.*)(<|>||%0A|%0D|%27|%3C|%3E|%00).* [NC,OR] 
RewriteCond %{HTTP_COOKIE}    ^.*(<|>||%0A|%0D|%27|%3C|%3E|%00).* [NC,OR] 
RewriteCond %{REQUEST_URI}    ^/(,|;|:|<|>|>|<|/|..).{0,9999}.* [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} ^$ [OR] 
RewriteCond %{HTTP_USER_AGENT} ^(java|curl|wget).* [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} ^.*(winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner).* [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} ^.*(libwww-perl|curl|wget|python|nikto|scan).* [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} ^.*(<|>||%0A|%0D|%27|%3C|%3E|%00).* [NC,OR] 
RewriteCond %{QUERY_STRING}     ^.*(;|<|>|||)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/*|union|select|insert|cast|set|declare|drop|update|md5|benchmark).*  [NC,OR] 
RewriteCond %{QUERY_STRING}    ^.*(localhost|loopback|127.0.0.1).* [NC,OR] 
RewriteCond %{QUERY_STRING}    ^.*.[A-Za-z0-9].* [NC,OR] 
RewriteCond %{QUERY_STRING}    ^.*(<|>|’|%0A|%0D|%27|%3C|%3E|%00).* [NC] 
RewriteCond %{QUERY_STRING} base64_encode.*(.*) [OR] 
RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR] 
RewriteCond %{QUERY_STRING} GLOBALS(=|[|%[0-9A-Z]{0,2}) [OR] 
RewriteCond %{QUERY_STRING} _REQUEST(=|[|%[0-9A-Z]{0,2}) 
RewriteRule ^(.*)$ index.php [F,L] 
RewriteCond %{QUERY_STRING} http://([a-zA-Z0-9_\-]*) [NC,OR] 
RewriteCond %{QUERY_STRING} http:/([a-zA-Z0-9_-]*) [NC,OR] 
RewriteCond %{QUERY_STRING} cmd= [NC,OR] 
RewriteCond %{QUERY_STRING} &cmd [NC,OR] 
RewriteCond %{QUERY_STRING} exec [NC,OR] 
RewriteCond %{QUERY_STRING} execu [NC,OR] 
RewriteCond %{QUERY_STRING} concat [NC] 
RewriteRule ^.* - [F] 
RewriteCond %{QUERY_STRING} UNION([%20 /*+]*)ALL([%20 /*+]*)SELECT [NC,OR] 
RewriteCond %{QUERY_STRING} UNION([%20 /*+]*)SELECT [NC,OR] 
RewriteCond %{QUERY_STRING} /* [NC,OR] 
RewriteCond %{QUERY_STRING} */ 
[NC
RewriteRule ^forum-([0-9]+).htmlforumdisplay.php?fid=$[L,QSA
RewriteRule ^forum-([0-9]+)-page-([0-9]+).htmlforumdisplay.php?fid=$1&page=$[L,QSA
RewriteRule ^thread-([0-9]+).htmlshowthread.php?tid=$[L,QSA
RewriteRule ^thread-([0-9]+)-page-([0-9]+).htmlshowthread.php?tid=$1&page=$[L,QSA
RewriteRule ^thread-([0-9]+)-lastpost.htmlshowthread.php?tid=$1&action=lastpost [L,QSA
RewriteRule ^thread-([0-9]+)-nextnewest.htmlshowthread.php?tid=$1&action=nextnewest [L,QSA
RewriteRule ^thread-([0-9]+)-nextoldest.htmlshowthread.php?tid=$1&action=nextoldest [L,QSA
RewriteRule ^thread-([0-9]+)-newpost.htmlshowthread.php?tid=$1&action=newpost [L,QSA
RewriteRule ^thread-([0-9]+)-post-([0-9]+).htmlshowthread.php?tid=$1&pid=$[L,QSA
RewriteRule ^post-([0-9]+).htmlshowthread.php?pid=$[L,QSA
RewriteRule ^announcement-([0-9]+).htmlannouncements.php?aid=$[L,QSA
RewriteRule ^user-([0-9]+).htmlmember.php?action=profile&uid=$[L,QSA
RewriteRule ^calendar-([0-9]+).htmlcalendar.php?calendar=$[L,QSA
RewriteRule ^calendar-([0-9]+)-year-([0-9]+).htmlcalendar.php?action=yearview&calendar=$1&year=$[L,QSA
RewriteRule ^calendar-([0-9]+)-year-([0-9]+)-month-([0-9]+).htmlcalendar.php?calendar=$1&year=$2&month=$[L,QSA
RewriteRule  ^calendar-([0-9]+)-year-([0-9]+)-month-([0-9]+)-day-([0-9]+).html$  calendar.php?action=dayview&calendar=$1&year=$2&month=$3&day=$4  [L,QSA
RewriteRule ^calendar-([0-9]+)-week-(n?[0-9]+).htmlcalendar.php?action=weekview&calendar=$1&week=$[L,QSA
RewriteRule ^event-([0-9]+).htmlcalendar.php?action=event&eid=$[L,QSA
</
IfModule



<
IfModule mod_deflate.c
    
AddOutputFilterByType DEFLATE application/javascript text/css text/html text/xml 
</IfModule