Htaccess 阻止字体真棒网络字体？

Posted 2023-03-03

技术标签:

【中文标题】Htaccess 阻止字体真棒网络字体？【英文标题】：Htaccess Blocking Font Awesome Web Fonts? 【发布时间】：2014-09-02 05:06:02 【问题描述】：

我认为我的 htaccess 文件中的某些内容阻止了 webfonts 显示在我的网站上。我对此不是 100% 的，但我已经禁用了安全插件和我网站上的所有内容，但它仍在发生。想知道是否有更有经验的人可以提供一些启示？

这些是我遇到的错误（访问链接会出现 403 错误）：

可下载字体：下载失败（字体系列：“FontAwesome”样式：正常粗细：正常拉伸：正常 src 索引：1）：状态=2147746065 来源：http://brandonmoner.me/wp-content/plugins/bean-shortcodes/assets/font/fontawesome-webfont.woff?v=3.1.0bean-shortcodes.css

可下载字体：下载失败（字体系列：“FontAwesome”样式：正常粗细：正常拉伸：正常 src 索引：2）：状态=2147746065 来源：http://brandonmoner.me/wp-content/plugins/bean-shortcodes/assets/font/fontawesome-webfont.ttf?v=3.1.0bean-shortcodes.css

到目前为止，这是我的 htaccess 中的内容：

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %REQUEST_FILENAME !-f
RewriteCond %REQUEST_FILENAME !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

# TURN OFF YOUR SERVER SIGNATURE
ServerSignature Off

# BEGIN GZIP
<ifmodule mod_deflate.c>
AddOutputFilterByType DEFLATE text/text text/html text/plain text/xml application/xml application/xhtml+xml text/javascript text/css application/x-javascript
BrowserMatch ^Mozilla/4 gzip-only-text/html
BrowserMatch ^Mozilla/4.0[678] no-gzip
BrowserMatch bMSIE !no-gzip !gzip-only-text/html
</ifmodule>
# END GZIP

# BEGIN EXPIRE HEADERS
<ifModule mod_expires.c>
ExpiresActive On
ExpiresDefault "access plus 5 seconds"
ExpiresByType image/x-icon "access plus 2592000 seconds"
ExpiresByType image/jpeg "access plus 2592000 seconds"
ExpiresByType image/png "access plus 2592000 seconds"
ExpiresByType image/gif "access plus 2592000 seconds"
ExpiresByType application/x-shockwave-flash "access plus 2592000 seconds"
ExpiresByType text/css "access plus 604800 seconds"
ExpiresByType text/javascript "access plus 216000 seconds"
ExpiresByType application/javascript "access plus 216000 seconds"
ExpiresByType application/x-javascript "access plus 216000 seconds"
ExpiresByType text/html "access plus 600 seconds"
ExpiresByType application/xhtml+xml "access plus 600 seconds"
</ifModule>
# END EXPIRE HEADERS

# BEGIN CACHE-CONTROL HEADERS
<ifModule mod_headers.c>
    <filesMatch "\.(ico|jpe?g|png|gif|swf)$">
        Header set Cache-Control "public"
    </filesMatch>
    <filesMatch "\.(css)$">
        Header set Cache-Control "public"
    </filesMatch>
    <filesMatch "\.(js)$">
        Header set Cache-Control "private"
    </filesMatch>
    <filesMatch "\.(x?html?|php)$">
        Header set Cache-Control "private, must-revalidate"
    </filesMatch>
</ifModule>
# END CACHE-CONTROL HEADERS

# DO NOT SHOW DIRECTORY LISTING
# If you are getting 500 Errors then comment out Options -Indexes
# by adding a # sign in front of it. If there is a typo anywhere in this file you will also see 500 errors.
Options -Indexes

# DIRECTORY INDEX FORCE INDEX.PHP
# Use index.php as default directory index file
# index.html will be ignored will not load.
DirectoryIndex index.php index.html /index.php

# DENY ACCESS TO PROTECTED SERVER FILES AND FOLDERS
# Files and folders starting with a dot: .htaccess, .htpasswd, .errordocs, .logs
RedirectMatch 403 \.(htaccess|htpasswd|errordocs|logs)$

# WP-ADMIN/INCLUDES
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]

# WP REWRITE LOOP START
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]

# REQUEST METHODS FILTERED
# This filter is for blocking junk bots and spam bots from making a HEAD request, but may also block some
# HEAD request from bots that you want to allow in certains cases. This is not a security filter and is just
# a nuisance filter. This filter will not block any important bots like the google bot. If you want to allow
# all bots to make a HEAD request then remove HEAD from the Request Method filter.
# The TRACE, DELETE, TRACK and DEBUG request methods should never be allowed against your website.
RewriteEngine On
RewriteCond %REQUEST_METHOD ^(HEAD|TRACE|DELETE|TRACK|DEBUG) [NC]
RewriteRule ^(.*)$ - [F,L]

# PLUGINS/THEMES AND VARIOUS EXPLOIT FILTER SKIP RULES
# IMPORTANT!!! If you add or remove a skip rule you must change S= to the new skip number
# Example: If RewriteRule S=5 is deleted than change S=6 to S=5, S=7 to S=6, etc.

# Adminer mysql management tool data populate
RewriteCond %REQUEST_URI ^/wp-content/plugins/adminer/ [NC]
RewriteRule . - [S=12]
# Comment Spam Pack MU Plugin - CAPTCHA images not displaying
RewriteCond %REQUEST_URI ^/wp-content/mu-plugins/custom-anti-spam/ [NC]
RewriteRule . - [S=11]
# Peters Custom Anti-Spam display CAPTCHA Image
RewriteCond %REQUEST_URI ^/wp-content/plugins/peters-custom-anti-spam-image/ [NC]
RewriteRule . - [S=10]
# Status Updater plugin fb connect
RewriteCond %REQUEST_URI ^/wp-content/plugins/fb-status-updater/ [NC]
RewriteRule . - [S=9]
# Stream Video Player - Adding FLV Videos Blocked
RewriteCond %REQUEST_URI ^/wp-content/plugins/stream-video-player/ [NC]
RewriteRule . - [S=8]
# XCloner 404 or 403 error when updating settings
RewriteCond %REQUEST_URI ^/wp-content/plugins/xcloner-backup-and-restore/ [NC]
RewriteRule . - [S=7]
# BuddyPress Logout Redirect
RewriteCond %QUERY_STRING action=logout&redirect_to=http%3A%2F%2F(.*) [NC]
RewriteRule . - [S=6]
# redirect_to=
RewriteCond %QUERY_STRING redirect_to=(.*) [NC]
RewriteRule . - [S=5]
# Login Plugins Password Reset And Redirect 1
RewriteCond %QUERY_STRING action=resetpass&key=(.*) [NC]
RewriteRule . - [S=4]
# Login Plugins Password Reset And Redirect 2
RewriteCond %QUERY_STRING action=rp&key=(.*) [NC]
RewriteRule . - [S=3]

# TIMTHUMB FORBID RFI and MISC FILE SKIP/BYPASS RULE
# Only Allow Internal File Requests From Your Website
# To Allow Additional Websites Access to a File Use [OR] as shown below.
# RewriteCond %HTTP_REFERER ^.*YourWebsite.com.* [OR]
# RewriteCond %HTTP_REFERER ^.*AnotherWebsite.com.*
RewriteCond %QUERY_STRING ^.*(http|https|ftp)(%3A|:)(%2F|/)(%2F|/)(w)0,3.?(blogger|picasa|blogspot|tsunami|petapolitik|photobucket|imgur|imageshack|wordpress\.com|img\.youtube|tinypic\.com|upload\.wikimedia|kkc|start-thegame).*$ [NC,OR]
RewriteCond %THE_REQUEST ^.*(http|https|ftp)(%3A|:)(%2F|/)(%2F|/)(w)0,3.?(blogger|picasa|blogspot|tsunami|petapolitik|photobucket|imgur|imageshack|wordpress\.com|img\.youtube|tinypic\.com|upload\.wikimedia|kkc|start-thegame).*$ [NC]
RewriteRule .* index.php [F,L]
RewriteCond %REQUEST_URI (timthumb\.php|phpthumb\.php|thumb\.php|thumbs\.php) [NC]
RewriteCond %HTTP_REFERER ^.*brandonmoner.me.*
RewriteRule . - [S=1]

# BEGIN QUERY STRING EXPLOITS
# The libwww-perl User Agent is forbidden - Many bad bots use libwww-perl modules, but some good bots use it too.
# Good sites such as W3C use it for their W3C-LinkChecker.
# Add or remove user agents temporarily or permanently from the first User Agent filter below.
# If you want a list of bad bots / User Agents to block then scroll to the end of this file.
RewriteCond %HTTP_USER_AGENT (havij|libwww-perl|wget|python|nikto|curl|scan|java|winhttp|clshttp|loader) [NC,OR]
RewriteCond %HTTP_USER_AGENT (%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
RewriteCond %HTTP_USER_AGENT (;|<|>|'|"|\)|\(|%0A|%0D|%22|%27|%28|%3C|%3E|%00).*(libwww-perl|wget|python|nikto|curl|scan|java|winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner) [NC,OR]
RewriteCond %THE_REQUEST \?\ HTTP/ [NC,OR]
RewriteCond %THE_REQUEST \/\*\ HTTP/ [NC,OR]
RewriteCond %THE_REQUEST etc/passwd [NC,OR]
RewriteCond %THE_REQUEST cgi-bin [NC,OR]
RewriteCond %THE_REQUEST (%0A|%0D|\\r|\\n) [NC,OR]
RewriteCond %REQUEST_URI owssvr\.dll [NC,OR]
RewriteCond %HTTP_REFERER (%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
RewriteCond %HTTP_REFERER \.opendirviewer\. [NC,OR]
RewriteCond %HTTP_REFERER users\.skynet\.be.* [NC,OR]
RewriteCond %QUERY_STRING [a-zA-Z0-9_]=http:// [NC,OR]
RewriteCond %QUERY_STRING [a-zA-Z0-9_]=(\.\.//?)+ [NC,OR]
RewriteCond %QUERY_STRING [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ [NC,OR]
RewriteCond %QUERY_STRING \=PHP[0-9a-f]8-[0-9a-f]4-[0-9a-f]4-[0-9a-f]4-[0-9a-f]12 [NC,OR]
RewriteCond %QUERY_STRING (\.\./|%2e%2e%2f|%2e%2e/|\.\.%2f|%2e\.%2f|%2e\./|\.%2e%2f|\.%2e/) [NC,OR]
RewriteCond %QUERY_STRING ftp\: [NC,OR]
RewriteCond %QUERY_STRING http\: [NC,OR]
RewriteCond %QUERY_STRING https\: [NC,OR]
RewriteCond %QUERY_STRING \=\|w\| [NC,OR]
RewriteCond %QUERY_STRING ^(.*)/self/(.*)$ [NC,OR]
RewriteCond %QUERY_STRING ^(.*)cPath=http://(.*)$ [NC,OR]
RewriteCond %QUERY_STRING (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %QUERY_STRING (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
RewriteCond %QUERY_STRING (\<|%3C).*embed.*(\>|%3E) [NC,OR]
RewriteCond %QUERY_STRING (<|%3C)([^e]*e)+mbed.*(>|%3E) [NC,OR]
RewriteCond %QUERY_STRING (\<|%3C).*object.*(\>|%3E) [NC,OR]
RewriteCond %QUERY_STRING (<|%3C)([^o]*o)+bject.*(>|%3E) [NC,OR]
RewriteCond %QUERY_STRING (\<|%3C).*iframe.*(\>|%3E) [NC,OR]
RewriteCond %QUERY_STRING (<|%3C)([^i]*i)+frame.*(>|%3E) [NC,OR]
RewriteCond %QUERY_STRING base64_encode.*\(.*\) [NC,OR]
RewriteCond %QUERY_STRING base64_(en|de)code[^(]*\([^)]*\) [NC,OR]
RewriteCond %QUERY_STRING GLOBALS(=|\[|\%[0-9A-Z]0,2) [OR]
RewriteCond %QUERY_STRING _REQUEST(=|\[|\%[0-9A-Z]0,2) [OR]
RewriteCond %QUERY_STRING ^.*(\(|\)|<|>|%3c|%3e).* [NC,OR]
RewriteCond %QUERY_STRING ^.*(\x00|\x04|\x08|\x0d|\x1b|\x20|\x3c|\x3e|\x7f).* [NC,OR]
RewriteCond %QUERY_STRING (NULL|OUTFILE|LOAD_FILE) [OR]
RewriteCond %QUERY_STRING (\.1,/)+(motd|etc|bin) [NC,OR]
RewriteCond %QUERY_STRING (localhost|loopback|127\.0\.0\.1) [NC,OR]
RewriteCond %QUERY_STRING (<|>|'|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
RewriteCond %QUERY_STRING concat[^\(]*\( [NC,OR]
RewriteCond %QUERY_STRING union([^s]*s)+elect [NC,OR]
RewriteCond %QUERY_STRING union([^a]*a)+ll([^s]*s)+elect [NC,OR]
RewriteCond %QUERY_STRING \-[sdcr].*(allow_url_include|allow_url_fopen|safe_mode|disable_functions|auto_prepend_file) [NC,OR]
RewriteCond %QUERY_STRING (;|<|>|'|"|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|drop|delete|update|cast|create|char|convert|alter|declare|order|script|set|md5|benchmark|encode) [NC,OR]
RewriteCond %QUERY_STRING (sp_executesql) [NC]
RewriteRule ^(.*)$ - [F,L]
# END QUERY STRING EXPLOITS
RewriteCond %REQUEST_FILENAME !-f
RewriteCond %REQUEST_FILENAME !-d
RewriteRule . /index.php [L]
# WP REWRITE LOOP END

# DENY BROWSER ACCESS TO THESE FILES
# wp-config.php, bb-config.php, php.ini, php5.ini, readme.html
# Replace Allow from 88.77.66.55 with your current IP address and remove the
# pound sign # from in front of the Allow from line of code below to access these
# files directly from your browser.

<FilesMatch "^(wp-config\.php|php\.ini|php5\.ini|readme\.html|bb-config\.php)">
Order allow,deny
Deny from all
#Allow from 88.77.66.55
</FilesMatch>

# BLOCK HOTLINKING TO IMAGES
# To Test that your Hotlinking protection is working visit http://altlab.com/htaccess_tutorial.html
#RewriteEngine On
#RewriteCond %HTTP_REFERER !^https?://(www\.)?brandonmoner\.me [NC]
#RewriteCond %HTTP_REFERER !^$
#RewriteRule .*\.(jpeg|jpg|gif|bmp|png)$ - [F]

这里有什么想法吗？

【问题讨论】：

那里有很多重写（和其他东西）（看起来也很混乱）——所以我建议你禁用其中的一部分来尝试找出阻止访问字体的原因。查看服务器的错误日志也可能提供有用的信息。 .htaccess example 可能会帮助您找出错误。 @Gunaseelan 谢谢。肯定会利用它。好的，所以目前我已经摆脱了 HTACCESS 文件中 WordPress 所需的所有基本规则。我还完全删除了其中一个安全插件。剩下的那个，我彻底检查了，没有一个选项会破坏我网站上的信息流。我还从本地安装切换回托管 CDN。 【参考方案1】：

您的 .htaccess 文件应该只控制对您的网站的访问。如果您在访问外部网站时遇到 403 错误，则可能是他们出于某种原因阻止了您。也许他们认为您正在尝试抓取/批量加载他们的网站，或者您来自一个不允许的 IP 地址，或者您的用户代理在禁止列表中或其他什么东西上。您可能必须向其他网站询问他们设置了哪些限制。如果他们试图阻止资源的“热链接”，那就不足为奇了。

【讨论】：

我认为字体文件在属于他的域——在他自己的wp-content文件夹中…… @bmoneruxui，您能否澄清一下您是否被阻止访问您的自己的站点的资源，或者它们是否在其他站点上？好吧，当我使用他们托管的 CDN 方法时，它说它无法从 CDN 路径下载字体。然后当我进行本地安装时，它说它失败并显示上面列出的消息。而且我认为他们不会阻止我进行抓取，因为这是很多人大量使用的资源。在第一次实施时，这两种方式都不起作用。如果您在 local 访问中遇到 403，最可能的原因是您的 .htaccess 中存在“热链接”保护（可能无法将您的[子]域），或某些恰好在您的 URL 上触发的黑客保护（UQS 内容）。您已经检查了足够的目录和文件权限？恐怕是时候通过您的 .htaccess 文件进行试错搜索了！谢谢你们的帮助。我会认真对待，看看我能找到什么。

以上是关于Htaccess 阻止字体真棒网络字体？的主要内容，如果未能解决你的问题，请参考以下文章

如何创建像字体真棒这样的图标

IIS 7 和字体真棒 .woff 404 错误

字体真棒字体

我的蓝鱼编码器上的页脚字体真棒图标没有响应

setState 不更新字体真棒图标

字体真棒字体未加载？

Htaccess 阻止字体 真棒网络字体？

Htaccess 阻止字体真棒网络字体？