Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The access control to my server is defined like this:

Order allow,deny
Allow from

And this works the way I want it. First, only access from the local machine is allowed and then everything else is denied. But I found lots of examples that would do something like this instead:

Order deny,allow
Deny from all
Allow from

This makes more sense. First, all access is denied and then, only local access is allowed.

My question is, are they equivalent and do exactly the same thing? They way I see it, they are, but I just want to make sure they are exactly the same. If not, how do they differ and which one should I go for to allow access to my local machine only?

share|improve this question
up vote 5 down vote accepted

Yes, they are equivalent in the aspect of both providing the same result, only allowing access from Let me quote the relevant part from the documentation on the Order directive.


First, all Allow directives are evaluated; at least one must match, or the request is rejected. Next, all Deny directives are evaluated. If any matches, the request is rejected. Last, any requests which do not match an Allow or a Deny directive are denied by default.


First, all Deny directives are evaluated; if any match, the request is denied unless it also matches an Allow directive. Any requests which do not match any Allow or Deny directives are permitted.

share|improve this answer

I do not believe they are actually the same, because in your first example you do not deny any hosts explicitly (unsure of what Apache defaults to if anything at all).

The second more regular example you showed is correct for allowing only the localhost to access the webserver. This is because the access control directives in Apache are applied in the order used by the Order directive. So with "deny,allow" first the deny directives are applied, then any allow directives. In this case all hosts are blocked first then is allowed. Nothing else can get in except localhost. If you were to reverse only the order making it "allow,deny" that would mean first is allowed, then all hosts are blocked. Meaning no one can get to the webserver at all (not even localhost)!

Just think of it as white/blacklisting. In the 'deny,allow' case with Deny from All you are essentially creating a whitelist of the users you want to be able to access the server, with each Allow from X you add. If you used 'allow,deny' with Allow from All and adding Deny from X you create a blacklist of people you specifically do not want to be able to access the webserver.

share|improve this answer
I understand all that, but both of them work the same way. That's what I'm trying to understand... Both deny everything but localhost. – Ricardo Amaral Jul 26 '11 at 17:25
I suppose then because there is nothing to match except, no one else can hit the webserver. – Nicholi Jul 26 '11 at 17:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.