Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I spent my evening on this problem and I did not find how to solve/bypass it :-(

I have in "mydomain.com/admin/" a .htaccess file with the following :

<Files ~ "[^index]\.php$">
Order Allow,Deny
Deny from All

The goal of this .htaccess is to protect all the included files, as inc/config.php for example, from being directly called.

My problem is that I wish to make an exception for a notification php file used by paypal. In other word, I have a file "mydomain.com/admin/paypal/notify.php" and I wish to allow paypal.com to execute it.

I tried tenth of things, as adding a "Files" authorization in the .htaccess

<Files /admin/paypal/notify.php>
Order Deny,Allow
Deny from all
Allow from paypal.com

But succesless :-(

... as if

<Files ~ "[^index]\.php$">

was the only followed rule.

Any idea ? Thank you in advance and best regards,


share|improve this question

migrated from stackoverflow.com Jun 23 '10 at 21:38

This question came from our site for professional and enthusiast programmers.

Does order the rules are applied matter in Apache? Meaning, do you need to block all php, then allow the one or visa versa? –  Tommy Jun 23 '10 at 20:34

2 Answers 2

Bear in mind that doing an allow from paypal.com will require the FQDN of the IP address hitting your site to be precisely paypal.com while looking through my logs, notifications come from notify.paypal.com (last three requests came from I don't have any in the previous five days, so, I can't confirm whether they all came from the same IP block.

share|improve this answer
thank you for your answers ! Unfortunately, I can't make it work :-( Don't you think that <Files ~ "[^index]\.php$"> blocks the access to /paypal/notify.php ?? But anyway, the fact that I need to use IPs instead of domain name makes me think I must change my strategy and use PHP to make controls : I don't want my notifications blocked because a Paypal IP is unknown by my htaccess :-) Thank you all... mhammout –  user46802 Jun 25 '10 at 9:12

<Files filename> only apply to a filename, you cannot use a path with it.

The Files directive documentation states:

The directives given within this section will be applied to any object with a basename (last component of filename) matching the specified filename.

Possible Solution:

In the directory admin/paypal, create an .htaccess with:

<Files notify.php>
  Order Deny,Allow
  Deny from All
  Allow from paypal.com

Edit: reversed Deny and Allow.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.