Member Avatar for Dani

What can I do to disable public downloading of my .htaccess file? I am on a Linux box. I can't chmod the file because the web browser still needs access to it, obviously. I know that there is a line I can add to it so that it gives the user a 403 Permission Denied error upon directly accessing it, but I don't remember what it is. Anyone know?

  • 6 Contributors
  • 11 Replies
  • 3K Views
  • 6 Years Discussion Span
  • Latest Post Latest Post by Member #585571

Dani AI

Generated

Best current approach (Apache 2.4+): deny any request for dot-ht* files using authz_core, not mod_rewrite. This is fast and explicit, and you can keep it in either your vhost or the directory’s .htaccess.

<Files ".ht*">
  Require all denied
</Files>

That rule targets .htaccess, .htpasswd, etc., and relies on the built‑in Require directive rather than legacy Order/Deny/Allow. See the Files container and Require docs for details. (httpd.apache.org)

’s rewrite with the [F] flag would work, but Apache must run the rewrite engine to evaluate it on each hit. The Files/Require check is cheaper and purpose‑built for access control. Also, small correction to ’s post #6: RewriteEngine On is absolutely valid in .htaccess when overrides permit it; the directive’s context includes .htaccess in the official docs. And since 2.4, the old Allow/Deny/Order syntax is deprecated in favor of Require, so prefer the rule above. (httpd.apache.org)

File permissions note for /: Apache must be able to read .htaccess. On shared hosting where Apache runs as a different user, chmod 700 will usually break things; use ownership/group and permissions that still allow the server user to read the file. For : toggling .htaccess to crawl is a blunt tool. If you truly need to disable .htaccess temporarily, set AllowOverride None on the target <Directory> in server config, reload Apache, and revert when done; that cleanly disables per‑dir configs. For hiding listings, skip IndexIgnore and simply turn off autoindexing:

Options -Indexes

See AllowOverride and Options for how these behave. (httpd.apache.org)

Recommended Answers

All 11 Replies

Member Avatar for treydawg

To prevent viewing of htaccess files use:

<Files .htaccess>
order allow,deny
deny from all
</Files>

and to prevent directory listing try:

IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti*

Trey B.
Web Hosting Support :D

Member Avatar for Dani

Hey there! Thanks! Helpful as always. :D

Member Avatar for Dani

I came across a cleaner way.

RewriteRule ^\.htaccess$ - &#91;F&#93;

The [F] means to make the file forbidden.

Member Avatar for Dani

Oops! Just remembered the rewrite rule (using mod_rewrite) won't work unless the rewrite engine is turned on. So the code in .htaccess has to look something like this

RewriteEngine on
RewriteRule ^\.htaccess$ - &#91;F&#93;
Member Avatar for treydawg

Unfortunately, all rewrite directives can be in the .htaccess except one.

RewriteEngine On must be in the httpd.conf of the server and not in the htaccess. Plus if you use rewrite there will be a performance penalty compared to just denying the file.

Just FYI, hope that helps.

Trey

Member Avatar for Dani

Hey, thanks. I thought of that one because I've been dealing with .htaccess and mod_rewrite, where it is required to put RewriteEngine on into .htaccess. Check out my post about mod_rewrite and google located here: [thread]653[/thread]
:) Dani

Member Avatar for Dani

BTW Yes, I've heard that mod_rewrite has a big performance hit to the cpu :(

Member Avatar for wfwh

Can you not chmod the file to 700? i think that still allows the file to be read :-/

Member Avatar for YUPAPA

Can you not chmod the file to 700? i think that still allows the file to be read :-/

Depending on the ownership of the .htaccess file, if you change permission to 0700 when the ownership of the file is owned by apache (or http, nobody, depending the user running apache), it may work ~

Otherwise, it gives you a forbidden error. :sad:

Member Avatar for tommytomato

Will this work for a spider search engine, I have a plugin that spiders web sites, but I cant seem to spider my own web site server which sits next to me.

here's the error message I get ( Timed out (no reply from server )

So if I disable the .htaccess file for a tick then spider my site then turn .htaccess back on, will this work.

By the way how do you turn .htaccess back on

TT

Member Avatar for Member #585571

This is a better one I think. It prevents .ht* from public access-

<FilesMatch "^\.ht">
Order deny,allow
Deny from All
Satisfy All
</FilesMatch>
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.