you may test this httpd.ini config.




########## Begin - Joomla! core SEF Section
############# Use this section if using ONLY Joomla! core SEF
## ALL (RewriteCond) lines in this section are only required if you actually
## have directories named 'content' or 'component' on your server
## If you do not have directories with these names, comment them out.
#
#
# 'nocase|NC' (no case)
# 'ornext|OR' (or next condition)
#
# ##optional - see notes##
# RewriteRule /component/option,com.* index.php [I,L]
RewriteRule (?:htm?|\.php|[^.]*) index.php [I,L]
RewriteRule (?:content/|/component/) index.php [I,L]
#
########## End - Joomla! core SEF Section

########## Begin - 3rd Party SEF Section
############# Use this section if you are using a 3rd party (Non Joomla! core) SEF extension - e.g. OpenSEF, 404_SEF, 404SEFx, SEF Advance, etc
#
# ##optional - see notes##
#RewriteRule /component/option,com.* index.php [I,L]
RewriteRule /content/(?:.*\.(?:html?|php)|[^.]*) index.php [I,L]
#
########## End - 3rd Party SEF Section

########## Begin - Rewrite rules to block out some common exploits
## If you experience problems on your site block out the operations listed below
## This attempts to block the most common type of exploit `attempts` to Joomla!
#
# Block out any script trying to set a mosConfig value through the URL
RewriteRule (?:mosConfig_[a-zA-Z_]{1,21}(=|\%3D)) / [I,F,L]

# Block out any script trying to base64_encode crap to send via URL
RewriteRule (?:base64_encode.*\(.*\)) / [I,F,L]

# Block out any script that includes a <script> tag in URL
RewriteRule (?:(\<|%3C).*script.*(\>|%3E)) / [I,F,L]

# Block out any script trying to set a PHP GLOBALS variable via URL
RewriteRule (?:GLOBALS(=|\[|\%[0-9A-Z]{0,2})) / [I,F,L]

# Block out any script trying to modify a _REQUEST variable via URL
RewriteRule (?:_REQUEST(=|\[|\%[0-9A-Z]{0,2})) / [I,F,L]

#
########## End - Rewrite rules to block out some common exploits