Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have this in my .htaccess file, in the site root:

Options -Indexes
<directory ../.*>
Deny from all
</directory> 

<Files .htaccess>
order allow,deny
deny from all
</Files>

<Files index.php>
Order allow,deny
allow from all
</Files> 

What I'm trying to achieve is to block folder and file access to anything that isn't called index.php, regardless of which directory is accessed. I have the folder part working perfectly and the deny from all rule is working as well - but my attempt to allow access to index.php is failing.

share|improve this question

migrated from superuser.com May 10 '10 at 22:42

This question came from our site for computer enthusiasts and power users.

1 Answer 1

Maybe you are thinking to complicated, just deny all access and then allow access to index.php and the folder itself. For example:

Order allow,deny
Deny from All

<FilesMatch "^(index\.php)?$">
        Allow from All
</FilesMatch>

If you don't even want http://doma.in/folder/ to work you can replace the FilesMatch directive with Files index.php. Keep in mind that it depends on your DirectoryIndex directive what file will be displayed when accessing a folder without filename.

Edit: To answer the question in your comment, I think you will need a more powerfull .htaccess using mod_rewrite. You can't use Directory and DirectoryMatch in a .htaccess file accordingly to the Apache documentation. Because the request is being denied before the RewriteRule can add a trailing slash you can't add the trailing slash with mod_write.

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !/index\.php$
    RewriteRule ^.*$ - [F]
</IfModule>

<IfModule !mod_rewrite.c>
    Order allow,deny
    Deny from All
</IfModule>
share|improve this answer
    
edit: That actually works for sub-directories if I add a trailing slash. Can I set it to work without a trailing slash? –  Oliver Nourish May 10 '10 at 15:53
    
Ok, working from your example I was able to accomplish 99% of what I wanted. Thanks for helping a .htaccess beginner! If you can show me how to allow access without a trailing slash, I'd still appreciate it. –  Oliver Nourish May 10 '10 at 16:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.