Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I restrict web access to parent folders of the main website directory. For example if I have the following directories/files:

├── home
│   └── user
│   │   ├── img.png
│   │   ├── script.js
│   │   └── page.html
└── var
    └── www
        └── index.html

and points to /var/www/, I don't /var/www/index.html to be able to access any files outside, in this case, img.png, script.js, page.html.

A few extra notes:

  • I am using suPHP so I can't go around and change permissions/owners to restrict access.
  • suPHP does not work with htaccess files[1], so I can't go around and disable ../ for the top most folder(s) [2].
  • Symbolic links must also be ignored in case / is linked to in /var/www
share|improve this question

It sounds like you need to enable the check_vhost_docroot option in order to ensure that the scripts is within DOCUMENT_ROOT:

share|improve this answer
Is this in the /etc/suphp/suphp.conf file? If so, would this also apply to, for example <script src="..."> statements? – puk Nov 7 '11 at 4:12
It would only apply to PHP scripts (that is, anything accessed by suPHP). Anything else accessed by Apache (not suPHP) is read using the webserver user permissions. – MV. Jun 17 '12 at 8:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.