Apache htaccess reliability

Question

I am denying access to certain files in the public_html folder with

<Files ~ "\.inc$">
    Order allow,deny
    Deny from all
</Files>

place in a .htaccess file.

I know it is best to put important files outside the public dir but I was wondering how reliable it is to refuse access with this (if it is possible to measure reliability)? Are there any tricks to get to those files?

Answer 1

To my knowledge it is reliable.
This of course can change fast, new bugs get discovered everyday.

However, one real concern is, if you make wrong change to your apache config and mistakenly disable parsing of .htaccess files without knowing/noticing it.
Then of course you are exposing these files.
While placing them outside of web reachable folders you avoid this possibility.

Answer 2

.htaccess is as reliable as any other Apache configuration directive, subject to the following caveats:

1. As faker pointed out above if you disable .htaccess parsing or protection in your main apache configuration they stop working.

2. If you disable specific .htaccess directives (e.g. removing AuthConfig from the AllowOverride line) those features stop working.

3. If the .htaccess file is writable by the Apache user (or any user that a CGI runs as) they can be modified by a sufficiently determined hacker.
   (This is actually a thing - Some Content Management Systems demand that they be able to modify the .htaccess file. It can become a serious thing if you have a brain-damaged Apache configuration with AllowOverride All)