200

I'm trying to deny users from accessing the site/includes folder by manipulating the URL.

I don't know if I have to deny everything and manually make individual exceptions to allow, if I can just deny this one folder, or if there's a rewrite function that can be used.

Specific example: I don't want to see the directory files by typing in localhost/site/includes into the URL.

Improve this question
1
  • 3
    just to disallow listing directories write Options -Indexes in .htaccess file located in root folder Commented Oct 1, 2013 at 14:15

11 Answers 11

Reset to default
284

Create site/includes/.htaccess file and add this line:

Deny from all
Improve this answer
Sign up to request clarification or add additional context in comments.

8 Comments

Hey!! anubhava I've used this to disable direct access to my api files inside /api folder but now all webservice call sending 403 forbidden status .. I just want to block access when someone access it from browser.
For a webserver there is no real difference between requests between browser and non-browser.
I use of nginx and I can not use of .htaccess. so, how can I do that without .htaccess ? thanks
Deny from all won't give 404 but 403. You can still access file/folders using PHP/Perl etc but not using a web request. You can open a new question if that didn't answer your query.
Note that if you want to use this, apache should allow it. In the site config <Directory>, you would need to have at least AllowOverride Limit.
|
95

You can also deny access to a folder using RedirectMatch

Add the following line to htaccess

RedirectMatch 403 ^/folder/?$

This will return a 403 forbidden error for the folder ie : http://example.com/folder/ but it doest block access to files and folders inside that folder, if you want to block everything inside the folder then just change the regex pattern to ^/folder/.*$ .

Another option is mod-rewrite If url-rewrting-module is enabled you can use something like the following in root/.htaccss :

RewriteEngine on RewriteRule ^folder/?$ - [F,L]

This will internally map a request for the folder to forbidden error page.

Improve this answer

6 Comments

With Apache 2.22 the best solution is the first one: RedirectMatch.....
Much prefer this answer, rather than creating multiple .htaccess files in every directory that I need to deny access for.
this is a much better answer than the one marked as correct, seriously
@user151496 That's debatable. The "accepted" answer is arguably more secure since the mod_alias (or mod_rewrite) directives used here in the root are more easily overridden (even accidentally).
@EatenByaGrue The rule is correct and it does what it says. If you want to block access to a specific file or folder/subfolder you can edit the rule accordingly.
|
50

In an .htaccess file you need to use

Deny from all

Put this in site/includes/.htaccess to make it specific to the includes directory

If you just wish to disallow a listing of directory files you can use

Options -Indexes
Improve this answer

4 Comments

Is this recursive?
@Abdillah Yes it is
i get an "internal server error 500" if i just add Options -Indexes to the bottom of the page? @OliverMGrech
Check if anything else in your htaccess is causing the server error. Apache's error log file might tell you what's missing or what's wrong
25

We will set the directory to be very secure, denying access for all file types. Below is the code you want to insert into the .htaccess file. 

Order Allow,Deny Deny from all

Since we have now set the security, we now want to allow access to our desired file types. To do that, add the code below to the .htaccess file under the security code you just inserted. 

<FilesMatch "\.(jpg|gif|png|php)$"> Order Deny,Allow Allow from all </FilesMatch>

your final .htaccess file will look like 

Order Allow,Deny Deny from all <FilesMatch "\.(jpg|gif|png|php)$"> Order Deny,Allow Allow from all </FilesMatch>

Source from Allow access to specific file types in a protected directory

Improve this answer

1 Comment

This answer saved me a lot of headache. Works like a charm.
11

Just put .htaccess into the folder you want to restrict

## no access to this folder # Apache 2.4 <IfModule mod_authz_core.c> Require all denied </IfModule> # Apache 2.2 <IfModule !mod_authz_core.c> Order Allow,Deny Deny from all </IfModule>

Source: MantisBT sources.

Improve this answer

Comments

9

You can create a .htaccess file for the folder, wich should have denied access with

Deny from all

or you can redirect to a custom 404 page

Redirect /includes/ 404.html
Improve this answer

Comments

8

On Apache 2.4 you can use an Apache <If> expression in the root .htaccess file to block direct access to this specific subdirectory and everything within it.

For example:

<If "%{REQUEST_URI} =~ m#^/site/includes($|/)#"> Require all denied </If>
Improve this answer

1 Comment

this is what i have been looking
4

Creating index.php, index.html, index.htm is not secure. Becuse, anyone can get access on your files within specified directory by guessing files name. E.g.: http://yoursite.com/includes/file.dat So, recommended method is creating a .htaccess file to deny all visitors ;). Have fun !!

Improve this answer

Comments

4

You can also put this IndexIgnore * at your root .htaccess file to disable file listing of all of your website directories including sub-dir

Improve this answer

1 Comment

This does not disable file listing, but tells the autoindexer to ignore all files when constructing the index. To disable file listing, you'd use Options -Indexes.
1

You can do this dynamically that way:

mkdir($dirname); @touch($dirname . "/.htaccess"); $f = fopen($dirname . "/.htaccess", "w"); fwrite($f, "deny from all"); fclose($f);
Improve this answer

Comments

0

For some reasons which I did not understand, creating folder/.htaccess and adding Deny from All failed to work for me. I don't know why, it seemed simple but didn't work, adding RedirectMatch 403 ^/folder/.*$ to the root htaccess worked instead.

Improve this answer

1 Comment

Apache server must be configured to support local .htaccess files in subdirectories. If it is not, creating local files will have no effect, obviously.