Make php file accessible only from scheduled tasks

Question

I have several php files that are aimed to run only from scheduled task. I don't want anyone to have access on these files by typing the url into browser or some other way... Is there a way to make this file accessible only for scheduled tasks? I use plesk control panel...

Answer 1

You want to create a .htaccess file with some rules to limit access to those files. This will affect Apache when it goes to serve the files via http, but will not affect the local server and things like running php code for accessing the files.

The Apache documentation has details for Files block here and the deny directive here. Anthonysomerset beat me to an example in his answer.

Answer 2

If your scheduled task uses the command line php then you could use htaccess to disallow access to the directory that your php file is in (or the php file itself).

A htaccess block will look similar to this:

<Files yourphpfile.php>
    order allow,deny
    deny from all
</Files>

Just drop this into an .htaccess file in the directory with your php file.

Answer 3

You can simply place the file(s) in question outside of the DocRoot (e.g. in /home/yourusername/cronscripts instead of /home/yourusername/public_html/cronscripts). There is then no way that your Web server can reach the files^*.

.htaccess is also a common approach, and has the advantage over the first option of working even if you aren't using command-line PHP to trigger the job. Typically, you'd use Allow and Deny statements to restrict what source IP address(es) can reach a given piece of code.

As a last-ditch option, or if you need to access the script from multiple locations or locations with changing IP addresses, consider using a shared secret, via code like:

if ( !isset($_GET['secretpass'])
  || $_GET['secretpass'] != 'hmAPcrkqjDhMkJw' )
{
    //Try to be fancy ("HTTP" response is for mod_php, "Status:" is for FastCGI)
    header("HTTP/1.1 404 Not Found");
    header( "Status: 404 File Not Found" );
    exit(0);

    //Or, if you'd rather, you can just:
    die( "Unauthorized access." );
}

Then when you call the script, only you know the right parameter to tack onto the end (http://somehost.com/somescript.php?secretpass=hmAPcrkqjDhMkJw).

^*: Unless you explicitly set up a separate script or a symlink to do so, of course, but now we're just being pedantic.