Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working on a website where I will need to use rewriting commands in .htaccess. It is not working and finally have traced the problem where I will need to set

"AllowOverride All" in my Apache httpd.conf

I am wondering if there are any security concern that I should be aware of when I change the setting from "AllowOverride None" to "AllowOverride All" ?


share|improve this question
up vote 5 down vote accepted

Good question, and the answer is yes there is a risk here for you to evaluate. It will allow a user who has write access to a particular directory to create a .htaccess file and overwrite various settings:

  • Auth settings
  • Limits, such as IP whitelists/blacklists
  • How filetypes are handled
  • Options on that directory

So a concrete example you have setup a global whitelist for a virtual host the user could overwrite that within the directory they can write to. Or they could overwrite your global settings requiring an authorized user.

For more of what can be done, see:

If its not a shared system the risk is fairly minimal as typically the entire web server instance will run as the same user so this is not really about what happens if someone cracks the webserver. It could be exploited if someone can find a hole in a script you have and can write an arbitrary file, lets say you have some kind of upload interface.

share|improve this answer
Thanks heaps! The info here definitely helps me! – forestclown Jan 19 '11 at 7:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.