Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have several php files that are aimed to run only from scheduled task. I don't want anyone to have access on these files by typing the url into browser or some other way... Is there a way to make this file accessible only for scheduled tasks? I use plesk control panel...

share|improve this question

You want to create a .htaccess file with some rules to limit access to those files. This will affect Apache when it goes to serve the files via http, but will not affect the local server and things like running php code for accessing the files.

The Apache documentation has details for Files block here and the deny directive here. Anthonysomerset beat me to an example in his answer.

share|improve this answer

If your scheduled task uses the command line php then you could use htaccess to disallow access to the directory that your php file is in (or the php file itself).

A htaccess block will look similar to this:

<Files yourphpfile.php>
    order allow,deny
    deny from all

Just drop this into an .htaccess file in the directory with your php file.

share|improve this answer
+1 for beating me to the punch with an example, although I would argue it was because you didn't take the time to capitalize or punctuate! – Caleb May 9 '11 at 10:13

You can simply place the file(s) in question outside of the DocRoot (e.g. in /home/yourusername/cronscripts instead of /home/yourusername/public_html/cronscripts). There is then no way that your Web server can reach the files*.

.htaccess is also a common approach, and has the advantage over the first option of working even if you aren't using command-line PHP to trigger the job. Typically, you'd use Allow and Deny statements to restrict what source IP address(es) can reach a given piece of code.

As a last-ditch option, or if you need to access the script from multiple locations or locations with changing IP addresses, consider using a shared secret, via code like:

if ( !isset($_GET['secretpass'])
  || $_GET['secretpass'] != 'hmAPcrkqjDhMkJw' )
    //Try to be fancy ("HTTP" response is for mod_php, "Status:" is for FastCGI)
    header("HTTP/1.1 404 Not Found");
    header( "Status: 404 File Not Found" );

    //Or, if you'd rather, you can just:
    die( "Unauthorized access." );

Then when you call the script, only you know the right parameter to tack onto the end (

*: Unless you explicitly set up a separate script or a symlink to do so, of course, but now we're just being pedantic.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.