Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am denying access to certain files in the public_html folder with

<Files ~ "\.inc$">
    Order allow,deny
    Deny from all

place in a .htaccess file.

I know it is best to put important files outside the public dir but I was wondering how reliable it is to refuse access with this (if it is possible to measure reliability)? Are there any tricks to get to those files?

share|improve this question
up vote 2 down vote accepted

.htaccess is as reliable as any other Apache configuration directive, subject to the following caveats:

  1. As faker pointed out above if you disable .htaccess parsing or protection in your main apache configuration they stop working.

  2. If you disable specific .htaccess directives (e.g. removing AuthConfig from the AllowOverride line) those features stop working.

  3. If the .htaccess file is writable by the Apache user (or any user that a CGI runs as) they can be modified by a sufficiently determined hacker.
    (This is actually a thing - Some Content Management Systems demand that they be able to modify the .htaccess file. It can become a serious thing if you have a brain-damaged Apache configuration with AllowOverride All)

share|improve this answer

To my knowledge it is reliable.
This of course can change fast, new bugs get discovered everyday.

However, one real concern is, if you make wrong change to your apache config and mistakenly disable parsing of .htaccess files without knowing/noticing it.
Then of course you are exposing these files.
While placing them outside of web reachable folders you avoid this possibility.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.