Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have asked the same question to stackoverflow but then I thought it might be more related to here.

in apache's httpd.conf between VirtualHost tags I put <LimitExcept> expression like follows:

<VirtualHost *:80>

 <LimitExcept HEAD POST GET>
     Deny from all

  ProxyRequests Off
  ProxyPreserveHost On

  <Proxy *>
    Order deny,allow
    Allow from all

  ProxyPass / http://XXXXXXXX...
  ProxyPassReverse / http://XXXXXXXX....

and then apache web server fails to start by giving following error:

Syntax error on line 513 of XXXXX/httpd.conf:
deny not allowed here

Although it says <LimitExcept> can be used in VirtualHost tag in offical docs why do I get this error?

in apache docs it says:

Context:    server config, virtual host, directory, .htaccess
share|improve this question
up vote 13 down vote accepted

As long as your <LimitExcept> block is within a context that's valid for the Allow/Deny directives, then it will work just fine.

If you try putting even a naked Deny rule directly in the <VirtualHost> context, you'll see that it's denied in the same way - <VirtualHost> with a Deny in it is not allowed, so neither adding a <LimitExcept> between them.

But, the trick is that <LimitExcept>, and some other block types like <IfModule>, do not modify the context of a directive; you'll never see "limit" in the list of acceptable contexts in the documentation for a directive.

There's are only four contexts that can dictate whether a directive is allowed:

  • server config
  • virtual host
  • directory (which includes <Location> and <Files> type directives, too)
  • .htaccess

In the case of the mod_authz_host directives (Order, Allow, and Deny), they're allowed only in directory and htaccess contexts, so they'll always error when they're not in one.

In your case, there's no filesystem location for this reverse-proxy vhost, so you'll want to use a <Location> block (which is a valid context for Allow/Deny because it's of the directory context type):

<Location />
    Order allow,deny
    Allow from all
    <LimitExcept HEAD POST GET>
        Deny from all

Oh, and get rid of that <Proxy *> block, as it's not doing anything - the <Location> takes precedence over it anyway, but it's in conflict with the <LimitExcept>'s restrictions.. so it makes me nervous.

share|improve this answer

The error message is saying that Deny is not allowed in a <LimitExcept> block.

From a different part of the docs: "The directives provided by mod_authz_host are used in <Directory>, <Files>, and <Location> sections as well as .htaccess files".

share|improve this answer
would it behave like I expected if I put <Directory> in <VirtualHost> and then put <LimitExcept> in <Directory> ? – destan Feb 3 '12 at 12:07
If you still had a Deny inside the <LimitExcept>, no. The problem is where you put the Deny. – Ladadadada Feb 3 '12 at 12:09
But when I do like that the server starts without error. Do you think the limit restriction won't work? – destan Feb 3 '12 at 12:24
@Ladadadada Actually it'll work when buried in a directory block (or a location block in this case, since there's no directory for a proxy config). See my answer. – Shane Madden Feb 3 '12 at 20:52
That makes perfect sense. – Ladadadada Feb 3 '12 at 21:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.