Note: This page is primarily geared towards users of the Apache family of web servers. If you are using Netscape Server or IIS, you will need to check their documentation for the specifics. Users of Stronghold and other Apache offspring should be okay.

srm.conf: Uncomment (remove the # sign) the following two lines:

AddType text/html .shtml
AddHandler server-parsed .shtml

access.conf: Find the line that names your Document Root and modify the OPTIONS line to read as follows:

Options Indexes FollowSymLinks Includes

ALLOWING SSI PAGES TO BE YOUR DIRECTORY INDEX PAGE
By default, your default or index page for a directory is usually set to index.html. In order to be able to also use index.shtml as a valid index page, modify either your httpd.conf or srm.conf file's DirectoryIndex directive to look as follows:

DirectoryIndex index.shtml index.html

You should also be able to place this line in your .htaccess file if you are unable to edit the master configuration files.

THE DIRECTORY CONFIGURATION METHOD
This method allows you to enable SSI in a particular directory. A popular method for those that do not have the permission to edit the main server configuration files, such as the virtually hosted crowd. It is also useful if you only want SSI to be enabled on part of your site.

Your server may not allow you to issue configuration directives from your directories. Check with your system administrator to see if your directories have what is called AllowOverride Options set. If not, kindly ask to have your sysadmin turn it on for you. (Kind, begging e-mail works best!)

To enable SSI in a given directory, either edit or create a file called .htaccess, and add the following line:

AddType text/html .shtml
AddHandler server-parsed .shtml
Options Indexes FollowSymLinks Includes

THE XBitHack METHOD
Relax, it is not something the family cat brought up after dinner, it just sounds that bad. The idea is this.....

Let's say you do not want to rename your pages to x.shtml from x.html because of blowing links, etc. Apache has a nice soution. If your server allows you to do it (see above begging information), the XbitHack can be a time saver. All you have to do is set the user's execute bit on to have the server parse the page. A what?

In unix, we have what are called file permissions. Normally, a page you own that is a web page would have permissions such as 644. This means that you can read and write to the file, and others can only read it. Nice security feature, huh?

Now, if we set the permission on the file to 744, which is read, write, and execute for user, and still read only for others, the server will know to parse the page.

In order to do this, you must add the following line to the .htaccess file:

XBitHack On

• The file will be in fact executable. If you accidently run it from the command line, with all the < and > in it, you can possibly trash your site and spend the rest of the day bringing up furballs.

• Do not willy nilly set the permissions. If you have a guestbook script (as an example) that does not filter out SSI directives, your guestbook becomes a hacker's delight. Only chmod 744 those files you really want the server to parse.

• For extra safety, do not chmod 744 files ending with .txt, .jpg, .gif and so on.

XBitHack Full

Then, use chmod 754 so that the group execute bit is set as well.