WordPress优化之设置浏览器端缓存:Leverage browser caching

网站上的静态内容,诸如:图片、CSS、JS、flash等,一般变动很小,甚至几个月都不会有所更改,这些体积庞大的静态内容占据了大部分网页加载时间。如何降低静态内容加载时间,甚至不需要(二次)加载静态内容,Leverage browser caching(浏览器端缓存)可以有效地解决这一问题,他使得浏览器可以缓存静态内容,使得浏览器不需要二次加载这些内容。

实现方法很简单,向.htaccess文件中添加以下代码:

#Expire Header
ExpiresActive on
ExpiresByType text/css "access 1 month"
ExpiresByType text/plain "access 2 days"
ExpiresByType text/html  "access 2 days"
ExpiresByType application/javascript "access 1 month"
ExpiresByType image/jpeg "access 1 month"
ExpiresByType image/x-icon "access 1 month"
ExpiresByType image/gif "access 1 month"
ExpiresByType image/png "access 1 month"
ExpiresByType image/ico "access 1 month"
ExpiresByType application/pdf "access 1 month"
ExpiresByType application/x-shockwave-flash "access 1 month"
ExpiresDefault "access 1 month"

#Expire Header
ExpiresActive on //开启缓存
ExpiresByType text/css “access 1 month”//css文件缓存1个月
ExpiresByType text/plain “access 2 days”//纯文本内容缓存2天
ExpiresByType text/html “access 2 days”//html文件缓存2天
ExpiresByType application/javascript “access 1 month”//JS文件缓存1个月
ExpiresByType image/jpeg “access 1 month”//jpeg图片缓存1个月
ExpiresByType image/x-icon “access 1 month”//icon缓存1个月
ExpiresByType image/gif “access 1 month”//gif图片缓存一个月
ExpiresByType image/png “access 1 month”//png图片缓存一个月
ExpiresByType image/ico “access 1 month”//ico缓存1个月
ExpiresByType application/pdf “access 1 month”//pdf文件缓存一个月
ExpiresByType application/x-shockwave-flash “access 1 month”//flash缓存一个月
ExpiresDefault “access 1 month”// 默认(未提及的可缓存文件)缓存1个月

 

保存后刷新网页,用Yslow测试可以看到,绝大部分内容都被缓存了。也就是说:读者第一次打开网页加载所有静态文件,以后再访问该页面,就不需要加载了。如果其他页面也使用相同的静态文件(比如js和css),那么访问其他页面也会很快(直接在浏览器的缓存里提取相应的静态内容)。

读者第一次打开网页加载静态文件并缓存,以后再访问该页面,就不需要加载

该方法需要apache的mod_expires,Ubuntu下用a2enmod expires开启。

Setting up awstats with apache 2 & geoip on debian-ubuntu

Awstats is a web log analyzer. It gives really useful statistics about traffic on your web sites.This log analyzer works as aCGI or from command line and shows you all possible information your log contains, in few graphical web Awstats Monthly Viewpages.

yesterday, it took me many hour to configure it on my server, I took help from many blogs to complete it.

Hope this can help someone.

1. Installing Awstats:

ab@web1:~$ sudo apt-get install awstats

This command will install awstats.Now we have to configure Apache.

2. Configuring Apache2:

Now make the following changes inawstats.conf file.

ab@web1:~$ sudo vi /etc/apache2/awstats.conf

Alias /awstatsclasses “/usr/share/awstats/lib/”
Alias /awstats-icon/ “/usr/share/awstats/icon/”
Alias /awstatscss “/usr/share/doc/awstats/examples/css”
ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
ScriptAlias /awstats/ /usr/lib/cgi-bin/
Options ExecCGI -MultiViews +SymLinksIfOwnerMatch

After, Making these changes, we have to include this file (/etc/apache2/awstats.conf) in to our apache.conf file, so we can access it over http.

ab@web1:~$ sudo vi /etc/apache2/apache2.conf

Include /etc/apache2/awstats.conf

Now, reload the apache.

ab@web1:~$  sudo /etc/init.d/apache2 reload

Now you can try to open http://www.mysite.com/awstats/awstats.pl but you will get this error:  Error: SiteDomain parameter not defined in your config/domain file. You must edit it for using this version of AWStats.

That means we have to configure Awstats.

3. Configuring Awstats:

By default awstats provides a default configuration file named /etc/awstats/awstats.conf. Copy this file to /etc/awstats/awstats.www.mysite.com.conf:

~$sudo cp /etc/awstats/awstats.conf /etc/awstats/awstats.www.mysite.com.conf

and edit the file:

~$sudo vi /etc/awstats/awstats.www.mysite.com.conf

and check for the following lines and edit those for your needs:

LogFile=”/var/log/apache2/access.log”
SiteDomain=”mysite.com”

This is all setted up, now you need to generate the first stats.

4. Generating the First Stats:

in order to generate the first stats, you need to call the script as root using the following command line:

~:$sudo -u www-data /usr/bin/perl /usr/lib/cgi-bin/awstats.pl -update -config=www.mysite.com

After finishing this you can try to open http://www.mysite.com/awstats/awstats.pl this will show you the stats.

Now for automatic update the stats you need to put the following command in your cron.

0 2 * * * www-data [ -x /usr/lib/cgi-bin/awstats.pl -a -f /etc/awstats/awstats.conf -a -r /var/log/apache/access.log ] && /usr/lib/cgi-bin/awstats.pl -config=mysite.com -update >/dev/null

GeoIP Information for AWStats

Improve country and city location information in your web analytics reports

Awstats showing country info

AWStats offers three different ways to provide Country level information about visitors (“hosts”) connecting to your site. By default, the host domain extension is used if you have performed reverse DNS look-up. While this results in human readable host names as well, reverse DNS lookup is time consuming. Alternatively, GeoIP plugins can be used. They match the host IP with a database of IP allocations which is already installed locally on your computer, significantly reducing the time needed to match a host to a location. There are two country level GeoIP databases available. AGeo::IPFree Perl module is available, but it does not appear that the database is being maintained. The better solution is MaxMind’s Geo::IP GeoLite Country open source version, said to be 97% accurate.

Download the current GeoLite Country, GeoLite City and Organization (AS Numbers)databases
wget http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz
wget http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz
wget http://geolite.maxmind.com/download/geoip/database/asnum/GeoIPASNum.dat.gz

Move data files to directory and unzip.

mv GeoIP.dat.gz /usr/local/share/GeoIP/
gunzip /usr/local/share/GeoIP/GeoIP.dat.gz
mv GeoLiteCity.dat.gz /usr/local/share/GeoIP/
gunzip /usr/local/share/GeoIP/GeoLiteCity.dat.gz
mv GeoIPASNum.dat.gz /usr/local/share/GeoIP/
gunzip /usr/local/share/GeoIP/GeoIPASNum.dat.gz
Install the GeoIP program.

1. wget http://geolite.maxmind.com/download/geoip/api/c/GeoIP-1.4.5.tar.gz
tar -xvzf GeoIP-1.4.5.tar.gz
cd GeoIP-1.4.5
./configure
make
make check
sudo make install

2.wget http://geolite.maxmind.com/download/geoip/api/perl/Geo-IP-1.35.tar.gz
tar -xvzf Geo-IP-1.35.tar.gz
cd Geo-IP-1.35
perl Makefile.PL LIBS=’-L/usr/local/lib’
make
make test
sudo make install

Update your awstats.mysite.conf configuration file

Look for the following geoip LoadPlugin options in your AWStats configuration file. Update them with the full path to each of the two database files.

LoadPlugin=”geoip GEOIP_STANDARD /usr/local/share/GeoIP/GeoIP.dat”
LoadPlugin=”geoip_city_maxmind GEOIP_STANDARD /usr/local/share/GeoIP/GeoLiteCity.dat”
LoadPlugin=”geoip_org_maxmind GEOIP_STANDARD /usr/local/share/GeoIP/GeoIPASNum.dat”

Well, It’s done and now you can check the stats with country info.

Cheers!!

DH的虚拟主机上是有GeoIP.dat的,可以这样找到路径:

$ locate GeoIP.dat
/usr/local/share/GeoIP/GeoIP.dat
/usr/share/GeoIP/GeoIP.dat

安装库模块:

perl -MCPAN -e ‘install “Geo::IP”‘

perl -MCPAN -e ‘install “Geo::IP::PurePerl”‘

我找到两个,比了一下时间,/usr/local那个要更新一点,所以用这个。所以,像下边这样修改common.conf:

找到
# LoadPlugin=”geoip GEOIP_STANDARD /pathto/GeoIP.dat”
取消注释,改为
LoadPlugin=”geoip GEOIP_STANDARD /usr/local/share/GeoIP/GeoIP.dat”

这样做,就可以开启GeoIP功能了,也就是在IP栏的右边,显示出IP所在国家。

如果,你认为DH的GeoIP.dat数据比较老,想使用比较新的,可以直接从MaxMind下载。可以下载GeoIP.dat.gzGeoLiteCity.dat.gz,之后解压,放在某处。假设放在/home/yourname/awstats/目录下。

LoadPlugin=”geoip GEOIP_STANDARD /pathto/GeoIP.dat”
LoadPlugin=”geoip_city_maxmind GEOIP_STANDARD /pathto/GeoIPCity.dat”
把以上两句改为:
LoadPlugin=”geoip GEOIP_STANDARD /home/awstats/awstats/GeoIP.dat”
LoadPlugin=”geoip_city_maxmind GEOIP_STANDARD /home/yourname/awstats/GeoIPCity.dat”

这样,就可以有国家和城市两栏显示了。

但是,这个城市显示比较粗糙一点,还可以利用QQ的纯真库IP信息来显示,有人做了一个这样的插件,qqhostinfo。需要以下步骤:

1. 下载纯真版IP数据库,解压缩后,只使用QQWry.dat
2. 下载qqhostinof.pm
3. 下载分析QQWry.dat的脚本
4. 把以上文件都放在cgi-bin/plugins下
5. 修改qqwry.pl,把./QQWry.dat改为${DIR}/plugins/QQWry.Dat
6. 修改common.conf,加入LoadPlugin=”qqhostinfo”

经过以上设置就可以了,会在GeoIPCity右边出现Location栏,里边有很具体的地址信息。

在使用qqhostinfo的时候,需要安装Net::XWhois模块。发现DH的主机上已经装了这个模块。

如果在没有的虚拟主机上安装,由于没有管理员权限,所以,正常的安装过程在make install的时候会报错的。所以,可以这样:

$ make Makefile.PL PREFIX=/home/yourname/awstats/lib # 这样可以把最后的安装都放在这个目录里
$ make
$ make install

另外,如果对中文搜索引擎统计有更高需求的话,可以使用车东的TOP 8 Chinese local search engines。这东西是将近一年前的,适用于AWStats-6.6,对于6.7来说不太合适。我做了一个6.7的search_engines.pm.patch,可以对search_engines.pm打patch。不管在本地,还是在DH主机的shell里,可以

patch search_engines.pm search_engines.pm.patch

 

1.更新若干有用的模块:      

       ppm install Geo::IP::PurePerl
       ppm install Geography::Countries
       ppm install IP::Country 
       ppm install Geo-IPfree
       ppm install  Net-Xwhois 

2.GeoIP和qqhostinfo需要下载相关文件

GeoIP需要GeoIP.dat;qqhostinfo需要qqhostinfo.pm、qqwry.pl、QQWry.dat3个文件,把他们都放到cgi-bin的插件目录里面.

GeoIP.dat,qqhostinfo.pm、qqwry.pl、QQWry.dat3 打包CSDN下载:
http://download.csdn.net/detail/debugcs/4360307

 

3、插件的开启

        开启 GeoIP 反查模块
       LoadPlugin=”geoip GEOIP_STANDARD C:/Perl/lib/GeoIP.dat”
       开启 IP 反查的外挂
       LoadPlugin=”geoipfree”
  
       # 开启 decodeutfkeys 外挂,解决“用以搜索的关键词”乱码
       LoadPlugin=”decodeutfkeys”    
     
       设定IIS的log时间
       LoadPlugin=”timezone +8″好了,所以的设置都弄好了,awstats已经能够很好的工作了。
       # Plugin: qqhostinfo,显示访问者地区,下面的语句需要手工添加。
       LoadPlugin=”qqhostinfo” 

       # 开启HostInfo,这个是qqhostinfo插件的前提

 

       LoadPlugin=”hostinfo”
*  上面插件加载地址按需修改 

日志统计页面GeoIP显示效果:

It may not be able to give the same level of detail as a commercial package such as Urchin, but it provides more than enough detail for most purposes.
On Ubuntu you can install awstats via apt:
apt-get install awstats
This will install the base package however, if you want to lever its full power you will need to install a couple of extra Perl modules.
apt-get install libnet-ip-perl
If you would like to see which countries your visitors are based in then you should look at one of the IP to Country plugins which will give you a Geo IP lookup.
You can choose between either geoipfree or GeoIp.
Other useful plugins are:

  • Plugin: HostInfo – which gives you a popup whois window
  • Plugin: IPv6 – adds IPv6 support
  • Plugin: Tooltips – confused by all the information? This will take away the mystery :)

On rpm-based system there is a handy little perl script that walks you through the initial configuration. On Ubuntu you have to do it by hand, however most of the configuration is self-explanatory.
Simply copy the provided sample config to a new config file:
cp awstats.conf awstats.yoursite.tld.conf
NB: You will need a separate configuration file for each vhost you wish to examine.
Edit the conf file to match your site’s setup. Important things to pay attention to are any domain aliases, the location of the log files and any IPs you wish to ignore (eg. your own)
You can also decide which optional plugins you want to load. Simply add a line to invoke each one:
LoadPlugin="geoipfree"
LoadPlugin="ipv6"
LoadPlugin="Tooltips"

geoipfree requires an extra perl module. On ubuntu the package is called libgeo-ipfree-perl
You are almost ready!
You now need to configure Apache to allow access to your awstats pages.
Rather than messing about with my main Apache config file I found it neater to place the awstats specific information in an external file called awstats.conf:

Options None
AllowOverride None
Order allow,deny
Allow from all

Alias /awstatsicons/ /usr/share/awstats/icon/
ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/

AllowOverride None
Options ExecCGI -MultiViews +SymLinksIfOwnerMatch
Order allow,deny
Allow from all


Then use an include directive in your main Apache config (apache2.conf):
Include /etc/apache2/awstats.conf
You then need to add it in to your vhost:
ScriptAlias /whereyouwanttoaccessit/ /usr/lib/cgi-bin/
If you navigate to:

http://www.yourdomain.tld/whereyouwanttoaccessit/awstats.pl?config=yourdomain.tld

You *should* be able to access your stats.
Of course you’ll need to actually generate the stats first:
/usr/lib/cgi-bin/awstats.pl -config=yourdomain.tld -update
I would recommend you run this from the command line once to create the first set of stats and then add a cronjob:
crontab -e
0,10,20,30,40,50 * * * * /usr/lib/cgi-bin/awstats.pl -config=yourdomain.tld -update >/dev/null
wq

This will update your stats every 10 minutes, which means that you’ll only have to update a few lines at a time. If your site is busy this makes sense :)
The last part of the line is important:
>/dev/null
By default cron emails the user each time it runs. You really don’t want 6 emails an hour telling you that Awstats has run :)

How to reset awstats

Just delete the files in /var/lib/awtstats (directory defined by DirData parameter)

sudo su - root
cd /var/lib/awstats
rm *
logout

Notes

  • you have to be root because for some reason, sudo rm -R awstats/* wouldn’t work.
  • if you get the message Never updated (See 'Build/Update' on awstats_setup.html page) whereas the awstats files are there in /var/lib/awtstats, it’s probably a permission problem on this folder.

绕过htaccess的限制工具-HTExploit

HTExploit是Black hat 2012发布的一款工具,由python编写并且开放源代码,用了.htaccess配置中身份验证和对web目录保护过程的弱点。可以通过使用这个工具绕过身份验证列出一个目录的保护内容。该工具提供了模块化的设计,允许渗透测试人员充分对受到保护的网站进行渗透测试:SQL注入,本地文件保护,远程文件保护,等等。

工具特点:

 

多个模块执行
输出保存到指定目录
html格式报告
可以使用wordlist

 

可用模块

 

detect  - 目录探测
full  - 使用字典方式探测url,查找脆弱的php文件

 

使用方法:

 

$python htexploit

 

运行之后如下:

 

| |  | | |__   __| |  ____|                | |         (_) | |
| |__| |    | |    | |__    __  __  _ __   | |   ___    _  | |_
|  __  |    | |    |  __|   \ \/ / | '_ \  | |  / _ \  | | | __|
| |  | |    | |    | |____   >  <  | |_) | | | | (_) | | | | |_
|_|  |_|    |_|    |______| /_/\_\ | .__/  |_|  \___/  |_|  \__|
                                   | |
                                   |_|  v1.0

Usage: htexploit -u [URL] [options]

Options:
-h, --help              show this help message and exit
 -m MODULE, --module=MODULE
                        Select the module to run (Default: detect)
-u URL, --url=URL     **REQUIRED** - Specify the URL to scan
-o OUTPUT, --output=OUTPUT
                        Specify the output directory
-w WORDLIST, --wordlist=WORDLIST
                        Specify the wordlist to use
-v, --verbose           Be verbose

例子:

 

 

python htexploit -u 10.10.10.10 -w FullList -o FolderPATH

下载地址

启用 Mac OS X 中的 Apache 和 PHP

Mac OS X 是自带 Apache 和 PHP 的,但默认情况下并没有开启,此文说明如何启用这两个服务,环境基于 Mac OS X 10.6 Snow Leopard。

启动 Apache

启动 Apache 有两种方法,一是图形化界面,而是命令行界面。

图形化的方法是打开「系统偏好设置」中「共享」的「Web 共享」。

mac_os_x_enable_web_share-480x363

Mac OS X 启用「Web 共享」

命令行方法是打开终端,Apache 服务需要 root 权限才能启动,所以执行以下命令:
sudo apachectl start

 

启用 PHP

修改 Apache 的配置文件,路径是 /etc/apache2/httpd.conf,把关于 PHP 的一行的注释(#)去掉:
LoadModule php5_module libexec/apache2/libphp5.so
然后重启 Apache 即可:
sudo apachectl restart

现在访问本机的网站试试:http://localhost/
如果成功会出现下面的成功页面。

mac_os_x_apache_works-480x182

Mac OS X 启动 Apache 成功

默认的网站根目录是 /Library/WebServer/Documents,在此目录下放一个 PHP 文件(如此文的info.php)来测试一下 PHP,文件内容简单如下即可:

访问此页面 http://localhost/info.php,测试结果如下:

mac_os_x_phpinfo-480x353

Mac OS X phpinfo

成功了。笔者使用的是 Mac OS X 10.6.3,从上面的页面可以看出系统自带的 PHP 版本是 5.3.1(2009-11-19),虽然不是最新的 5.3.2(2010-03-04),但也不算旧了。

另外每个系统中的用户都有自己的站点,启动「Web 共享」即 Apache 之后就可以访问了,每个用户的站点的 URL 是 http://localhost/~username/。如果系统的防火墙设置没有阻止 Web 共享的话,网络用户就可以通过类似下面的 URL 来访问各个站点了:

http://192.168.0.168/~username/

其中 192.168.0.168 是主机在网络中的 IP 地址,username 是系统中的用户名,如下图所示:

mac_os_x_user_site-480x353

Mac OS X 用户站点