Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I spent my evening on this problem and I did not find how to solve/bypass it :-(

I have in "" a .htaccess file with the following :

<Files ~ "[^index]\.php$">
Order Allow,Deny
Deny from All

The goal of this .htaccess is to protect all the included files, as inc/config.php for example, from being directly called.

My problem is that I wish to make an exception for a notification php file used by paypal. In other word, I have a file "" and I wish to allow to execute it.

I tried tenth of things, as adding a "Files" authorization in the .htaccess

<Files /admin/paypal/notify.php>
Order Deny,Allow
Deny from all
Allow from

But succesless :-(

... as if

<Files ~ "[^index]\.php$">

was the only followed rule.

share|improve this question

migrated from Jun 23 '10 at 21:38

This question came from our site for professional and enthusiast programmers.

Does order the rules are applied matter in Apache? Meaning, do you need to block all php, then allow the one or visa versa? – Tommy Jun 23 '10 at 20:34

<Files filename> only apply to a filename, you cannot use a path with it.

The Files directive documentation states:

The directives given within this section will be applied to any object with a basename (last component of filename) matching the specified filename.

Possible Solution:

In the directory admin/paypal, create an .htaccess with:

<Files notify.php>
  Order Deny,Allow
  Deny from All
  Allow from

Edit: reversed Deny and Allow.

share|improve this answer

Bear in mind that doing an allow from will require the FQDN of the IP address hitting your site to be precisely while looking through my logs, notifications come from (last three requests came from I don't have any in the previous five days, so, I can't confirm whether they all came from the same IP block.

share|improve this answer
thank you for your answers ! Unfortunately, I can't make it work :-( Don't you think that <Files ~ "[^index]\.php$"> blocks the access to /paypal/notify.php ?? But anyway, the fact that I need to use IPs instead of domain name makes me think I must change my strategy and use PHP to make controls : I don't want my notifications blocked because a Paypal IP is unknown by my htaccess :-) Thank you all... mhammout – user46802 Jun 25 '10 at 9:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.