Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When someone fetches a denied URL that exists, he gets:


You don't have permission to access /admin/admin.php on this server.
Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.9 with Suhosin-Patch Server

When someone goes to a URL that does not exist he will get:

Not Found

The requested URL /notexisting/notthere.php was not found on this server.
Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.9 with Suhosin-Patch Server 

This way someone can find out information about the directory structure in an area, that is actually not open to the public. Is this true?

If I were paranoid, what could I do? Just curious.

share|improve this question
up vote 0 down vote accepted

You could probably use SetEnvIf to check for something, like whether Remote_Addr is internal or not, and then use mod_rewrite to give 404's based on the environment variable.

share|improve this answer

Note this doesn't necessarily tell them that /admin/admin.php exists. If /admin were forbidden, /admin/notthere.php would also be a 403 Forbidden. So it's not explicitly giving away any information about your directory structure.

If you are paranoid, you could create a subdomain where the root is protected. That way, for an unauthorized user, any url will result in a 403 Forbidden message

share|improve this answer

You can configure the way Apache reacts to error, for example by setting an ErrorDocument for each error:

share|improve this answer
but this would not change the http result code? an attacker could still look for it? – user12096 Apr 26 '10 at 9:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.