# Chrome Blocked Site, phpinfo() and .htaccess

**URL:** <https://forum.infinityfree.com/t/chrome-blocked-site-phpinfo-and-htaccess/108653>\
**Category:** Hosting Support\
**Created:** [April 10, 2025, 2:43pm UTC](https://forum.infinityfree.com/t/chrome-blocked-site-phpinfo-and-htaccess/108653 "2025-04-10T14:43:47Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![BrainzUK](https://forum.infinityfree.com/letter_avatar/brainzuk/32/5_5575768a8748004e209b776fc1b2916d.png) [@BrainzUK](https://forum.infinityfree.com/u/BrainzUK)\
**Post date:** [April 10, 2025, 2:43pm UTC](https://forum.infinityfree.com/t/chrome-blocked-site-phpinfo-and-htaccess/108653/1 "2025-04-10T14:43:47Z")

</div>

### Website URL

I have hit a problem when chrome has decided that my site is unsafe, which I am trying to fix, but am hitting some issues.

First, I don’t seem to be able to check PHP Info using phpinfo(). PHP version is 8.2  
Also, No matter what I put in my .htaccess file, this does not seem to actually turn on the relevant security modules.  
How can I get the server to actually use the .htaccess file?

This is what I have in it currently…

```auto
# Force HTTPS
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteCond %{HTTPS} off
RewriteCond %{HTTP:CF-Visitor} !{"scheme":"https"}
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Security Headers
<IfModule mod_headers.c>
    # Content Security Policy
    Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://code.jquery.com; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; font-src 'self' https://cdnjs.cloudflare.com data:; img-src 'self' data: https:; connect-src 'self';"
    
    # HTTP Strict Transport Security
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    
    # X-Content-Type-Options
    Header set X-Content-Type-Options "nosniff"
    
    # X-Frame-Options
    Header set X-Frame-Options "SAMEORIGIN"
    
    # X-XSS-Protection
    Header set X-XSS-Protection "1; mode=block"
    
    # Referrer-Policy
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    
    # Permissions-Policy
    Header set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>

```

---

<div class="post-metadata">

**Author:** ![KangJL](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/kangjl/32/12130_2.png) [@KangJL](https://forum.infinityfree.com/u/KangJL)\
**Post date:** [April 10, 2025, 3:01pm UTC](https://forum.infinityfree.com/t/chrome-blocked-site-phpinfo-and-htaccess/108653/2 "2025-04-10T15:01:57Z")

</div>

> [@BrainzUK](#):
>
> hit a problem when chrome has decided that my site is unsafe

Please read

> [@Why Do I See a "Deceptive Site Ahead" Warning on My Website?](https://forum.infinityfree.com/t/why-do-i-see-a-deceptive-site-ahead-warning-on-my-website/99495/1):
>
> If you’re trying to access your website and encounter a bright red warning page that looks something like this: Deceptive site ahead Firefox blocked this page because it may trick you into doing something dangerous like installing software or revealing personal information such as passwords or credit cards. Advisory provided by [Google Safe Browsing](https://developers.google.com/safe-browsing/v4/advisory). Don’t worry - you’re not alone. This article will explain what this warning means, why it appears, and what steps you can take to fix it. What…

> [@BrainzUK](#):
>
> I don’t seem to be able to check PHP Info using phpinfo(). PHP version is 8.2  
> Also, No matter what I put in my .htaccess file

You are barking up the wrong tree. It does not even relate to your first issue

---

<div class="post-metadata">

**Author:** ![BrainzUK](https://forum.infinityfree.com/letter_avatar/brainzuk/32/5_5575768a8748004e209b776fc1b2916d.png) [@BrainzUK](https://forum.infinityfree.com/u/BrainzUK)\
**Post date:** [April 10, 2025, 3:06pm UTC](https://forum.infinityfree.com/t/chrome-blocked-site-phpinfo-and-htaccess/108653/3 "2025-04-10T15:06:21Z")

</div>

Yes, I have read all that and following steps to try and ensure that site is secure.  
Checking the site on [HTTP Header Security Test - HTTP Observatory | MDN](https://developer.mozilla.org/en-US/observatory) and [https://securityheaders.com/](https://securityheaders.com/) show various security things that can be improved, hence trying to use .htaccess to resolve.  
But as I say, even with the .htaccess as original message these things are not resolved.

---

<div class="post-metadata">

**Author:** ![KangJL](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/kangjl/32/12130_2.png) [@KangJL](https://forum.infinityfree.com/u/KangJL)\
**Post date:** [April 10, 2025, 3:11pm UTC](https://forum.infinityfree.com/t/chrome-blocked-site-phpinfo-and-htaccess/108653/4 "2025-04-10T15:11:03Z")

</div>

If you did read, then you would not be doing this

![image](https://forum-cdn.infinityfree.net/original/3X/8/a/8a8a979383b843e3b98fed6f6e33e702864d6961.png)

So read the post again

---

<div class="post-metadata">

**Author:** ![BrainzUK](https://forum.infinityfree.com/letter_avatar/brainzuk/32/5_5575768a8748004e209b776fc1b2916d.png) [@BrainzUK](https://forum.infinityfree.com/u/BrainzUK)\
**Post date:** [April 10, 2025, 3:37pm UTC](https://forum.infinityfree.com/t/chrome-blocked-site-phpinfo-and-htaccess/108653/5 "2025-04-10T15:37:18Z")

</div>

If we focus on one problem at a time. back to the .htaccess issue…

Using another host service, adding exactly the same .htaccess file fixes most of the vulnerabilities as listed on the security scan sites.  
So why doesn’t the .htaccess on [Infinityfree.com](http://Infinityfree.com) seem to have any effect?

---

<div class="post-metadata">

**Author:** ![Greenreader9](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/greenreader9/32/22847_2.png) [@Greenreader9](https://forum.infinityfree.com/u/Greenreader9)\
**Post date:** [April 10, 2025, 3:40pm UTC](https://forum.infinityfree.com/t/chrome-blocked-site-phpinfo-and-htaccess/108653/6 "2025-04-10T15:40:06Z")

</div>

> [@BrainzUK](#):
>
> So why doesn’t the .htaccess on [Infinityfree.com](http://Infinityfree.com) seem to have any effect?

Looks like it worked to me:

 ![image](https://forum-cdn.infinityfree.net/original/3X/2/1/21a5f122a1e3127cb2fd683c371c1c72a3b3fb36.png)

---

<div class="post-metadata">

**Author:** ![dan3008](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/dan3008/32/53336_2.png) [@dan3008](https://forum.infinityfree.com/u/dan3008)\
**Post date:** [April 10, 2025, 3:41pm UTC](https://forum.infinityfree.com/t/chrome-blocked-site-phpinfo-and-htaccess/108653/7 "2025-04-10T15:41:56Z")

</div>

If you’re not seeing the effect of your .htaccess file, maybe clear your browswer cache, or try an incognito window.

Browser cache can be a right pain in the…

---

<div class="post-metadata">

**Author:** ![wasik405](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/wasik405/32/55080_2.png) [@wasik405](https://forum.infinityfree.com/u/wasik405)\
**Post date:** [April 10, 2025, 3:43pm UTC](https://forum.infinityfree.com/t/chrome-blocked-site-phpinfo-and-htaccess/108653/8 "2025-04-10T15:43:11Z")

</div>

Your `.htaccess` is functioning properly (as GR9 mentioned), but those security scan sites are unable to access your site and cannot mark it as ‘fixed’ due to this security system:

> [@Ensuring only web browsers can access your website](https://forum.infinityfree.com/t/ensuring-only-web-browsers-can-access-your-website/49353):
>
> InfinityFree is a website hosting service. That means that the hosting accounts we provided are intended for hosting websites. Websites contain pages that are accessed through web browsers. InfinityFree is not intended to be used for file sharing, API hosting, database hosting or background tasks/tools. To help enforce this, free hosting enforces a security system that makes sure that anyone trying to access your website is using a normal web browser. This is done by checking whether the web br…

---

<div class="post-metadata">

**Author:** ![BrainzUK](https://forum.infinityfree.com/letter_avatar/brainzuk/32/5_5575768a8748004e209b776fc1b2916d.png) [@BrainzUK](https://forum.infinityfree.com/u/BrainzUK)\
**Post date:** [April 10, 2025, 4:02pm UTC](https://forum.infinityfree.com/t/chrome-blocked-site-phpinfo-and-htaccess/108653/9 "2025-04-10T16:02:20Z")

</div>

Got it. So would the premium option lift this limitation?

I didn’t think that this would be an issue, its just a basic web based application, but I can understand if that’s the issue.

---

<div class="post-metadata">

**Author:** ![Greenreader9](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/greenreader9/32/22847_2.png) [@Greenreader9](https://forum.infinityfree.com/u/Greenreader9)\
**Post date:** [April 10, 2025, 4:38pm UTC](https://forum.infinityfree.com/t/chrome-blocked-site-phpinfo-and-htaccess/108653/10 "2025-04-10T16:38:39Z")

</div>

> [@BrainzUK](#):
>
> So would the premium option lift this limitation?

Yes, premium-hosting does not have that security system installed.

---

<div class="post-metadata">

**Author:** ![BrainzUK](https://forum.infinityfree.com/letter_avatar/brainzuk/32/5_5575768a8748004e209b776fc1b2916d.png) [@BrainzUK](https://forum.infinityfree.com/u/BrainzUK)\
**Post date:** [April 10, 2025, 4:39pm UTC](https://forum.infinityfree.com/t/chrome-blocked-site-phpinfo-and-htaccess/108653/11 "2025-04-10T16:39:46Z")

</div>

Thank You. That sounds like the way to go. I appreciate your help.

---

<div class="post-metadata">

**Author:** ![Admin](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/admin/32/36437_2.png) [@Admin](https://forum.infinityfree.com/u/Admin)\
**Post date:** [April 10, 2025, 7:55pm UTC](https://forum.infinityfree.com/t/chrome-blocked-site-phpinfo-and-htaccess/108653/12 "2025-04-10T19:55:00Z")

</div>

> [@BrainzUK](#):
>
> Also, No matter what I put in my .htaccess file, this does not seem to actually turn on the relevant security modules.  
> How can I get the server to actually use the .htaccess file?

How are you checking for these security headers exactly? Please note that any automated security header checkers may be blocked on our servers, so it’s possible the headers just work even if you can’t check them.

* * *

That said, these headers won’t help you with your unsafe site issue.

These warnings usually indicate that Google has classified your website as a “deceptive site”, i.e. trying to trick people into submitting (personal) information.

Enforcing a valid SSL certificate or setting a CSP header won’t help you there. After all, a phishing site that follows all the security best practices is still a phishing site.

---

<div class="post-metadata">

**Author:** ![system](https://infinityfree-forum-uploads.s3.dualstack.eu-central-1.amazonaws.com/original/3X/b/0/b024fd3fa88bae093c9576e55c2c94e33f890206.svg) [@system](https://forum.infinityfree.com/u/system)\
**Post date:** [April 17, 2025, 7:55pm UTC](https://forum.infinityfree.com/t/chrome-blocked-site-phpinfo-and-htaccess/108653/13 "2025-04-17T19:55:56Z")

</div>

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.