Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been experimenting with the FilesMatch Directive. During my first attempt, I discovered that my default rules (rulesets 1 & 2) didn't allow me to access but did allow me to access

I presumed this was because the file "/" hit ruleset 1 but not ruleset 2 and so got blocked. I therefore put ruleset 3 in place and everything seems to be working now. I just wanted to ask if anyone had any advice on implementing this directive, and whether or not I've gone about it the correct way?

<FilesMatch "^.*$">
        Order Deny,Allow
        Deny from all

<FilesMatch "^.*\.(css|html?|js|pdf|txt|xml|xsl|gif|ico|jpe?g|png|php?)$">
        Order Deny,Allow
        Allow from all

<FilesMatch "">
        Order Deny,Allow
        Allow from all
share|improve this question

This likely isn't working as you're intending.

Your last match effectively overrides the other rules and allows all requests; "" will always match everything (as will your first section, "^.*$").

Just using <FilesMatch> seems like the wrong approach for what you're going for, but can you clarify what you're trying to achieve?


Something like this should function for both cases:

<Location />
    Order deny,allow
    Deny from all
<LocationMatch "(/|\.css|\.html?|\.js|\.pdf|\.txt|\.xml|\.xsl|\.gif|\.ico|jpe?g|\.png|\.php)$">
    Allow from all
share|improve this answer
I'm trying to put in place some CIS guidelines. Namely these ones: 1.5.11 Restrict File Extensions (Level 2, Scorable) Description: Restrict access to inappropriate file extensions that are not expected to be a legitimate part of web sites using the FileMatch directive. They work in part, but the also block a site when a user accesses because the "/" doesn't match a rule in the whitelist. – leftcase Jun 28 '12 at 9:26
@leftcase Edited answer with a config that should fit your needs. – Shane Madden Jun 28 '12 at 18:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.