When Apache determines that a requested resource actually represents a file on the disk, it starts a process called the 'directory walk.' This involves checking through its internal list of <Directory> containers to find those that apply, and possibly searching the directories on the filesystem for .htaccess files.

Each time the directory walk finds a new set of directives that apply to the request, they are merged with the settings already accumulated. The result is a collection of settings that apply to the final document, culled from all of its ancestor directories and the server's config files.

When searching for .htaccess files, Apache starts at the top of the filesystem. (On Windows, that usually means 'C:\'; otherwise, the root directory '/'.) It then walks down the directories to the one containing the final document, processing and merging any .htaccess files it finds that the config files say should be processed. (See the section on overrides for more information on how the server determines whether an .htaccess file should be processed or not.)

• Added "Auto-Lockout" - protection from a "brute" force attack - when there are attempts to send multiple invalid username/password combinations, IP address gets blacklisted;
• Fixed a problem with creating directories - creating directories on the 3rd of lower level (e.g. "aa/bb/cc") was causing disconnects;

Not all directives will work in .htaccess files; for example, it makes no sense to allow a ServerName directive to appear in one, since the server is already running and knows its name -- and cannot change it -- by the time a request would cause the .htaccess file to be read. Other directives aren't allowed because they deal with features that are server-wide, or perhaps are too sensitive.

A VirtualHost configuration file tells Apache the specifics about your web site. It contains information like what IP and port number your site runs on, the server name and any aliases, the local filesystem path (or document root) of your web pages, location of your cgi-bin, file names and paths of your access and error logs, custom error documents for HTTP errors like 404 File Not Found, and can have many other items. For every web site you want Apache to host you must create a virtual host configuration. You've already gotten a taste of a virtual host config when we added the default VirtualHost for handling IP address requests in httpd.conf, so what we're going to be doing now is nothing new. I'm now going to show you an easy way of managing all your virtual hosts.

When we installed mod_ssl, a file called ssl.conf was written to /etc/httpd/conf.d that contains basic SSL configuration information. We're going to use this as our template for adding a SSL based virtual host. What we'll do is make a copy of it to our vhosts directory and remove the non-website specific information since it should only be loaded once by Apache. This non-website specific information pertains to loading the mod_ssl Apache module among other things while everything else in the file relates to configuring the SSL web site (what we're interested in).

Let's make a copy of ssl.conf to the vhosts directory which you should still be in (cd /etc/httpd/conf/vhosts). Following the same format for our virtual host config files (host.domain.tld.port.conf) as before, we will be naming our SSL virtual host file as your-domain.com.443.conf. The port number for SSL is 443 so we'll use that as opposed to port 80 when we created the HTTP VirtualHost. After that we'l open the config file in nano so we can begin editing it.