Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a multisite installed in the root directory ( and also a wordpress single installation on a subdomain (

In the root .htaccess we placed:

#START Security: Disallow access to folders
Options All -Indexes
# END Security

On the main site (as expected we get)

"403 Permission Denied. You do not have permission for this request /wp-content/blogs.dir/83/"

Nice. :)

BUT. We just noticed that when trying to access the subdomains folders we get:

Internal Server Error. The server encountered an internal error or misconfiguration and was unable to complete your request.... Additionally, a 500 Internal Server Error error...

This is something we do NOT want.

So the question is:

How can we avoid the above result and make the message for the subdomains be "403 Permission Denied" (the same as for the main site and NOT "500 Internal Server Error" (as it is now)? We put what, where?

share|improve this question

migrated from Jul 6 '12 at 23:26

This question came from our site for WordPress developers and administrators.

@EAMann I thought the question fell under the category of "server configuration for WordPress" -as per the FAQ- since they are both WordPress installations/databases. Please feel free to edit/moderate it accordingly or even delete this question if you find that ProWebmasters or Server Fault would be more appropriate places to ask. Thank you for helping out. – marikamitsos Jul 6 '12 at 23:21
Security issues with htaccess are not WordPress specific. The fact that your site just happens to be powered by WP doesn't automatically make this on-topic for us. However, I'll migrate it to Server Fault for you. – EAMann Jul 6 '12 at 23:26
Internal server errors should result in an error log message. What does the error log say? – mgorven Jul 7 '12 at 4:25
@mgorven I just checked and actually could NOT find any error messages in the log files. On the other hand though the .htaccess file itself is modified. !!! Meaning: the Options All -Indexes I had added there is now commented out and under it there is another line reading: Options ExecCGI Includes IncludesNOEXEC SymLinksIfOwnerMatch -Indexes. Most likely auto filled by my host (Bluehost). I have NO clue of what that means and more than that I am still in the dark. :( – marikamitsos Jul 7 '12 at 5:08
up vote 0 down vote accepted

I finally found the answer to my own question

After being puzzled for quite a few many days, someone else (outside these forums) provided the answer. It is quite simple actually. The only action one has to take is to omit the word: All

#START Security: Disallow access to folders
Options -Indexes
# END Security

The best thing is that if (as we did) you place the above in the root directory it "takes care" of all (if any) directories in all subdomain you may have in your server as well. !!!

For those who want to know: The reason why the first attempt (Options All -Indexes) does not work is because the .htaccess file applies rules to the directory that it's in, so you must NOT include that directory again.

The funniest thing is that we've been trying to convince our host to give us an answer to this for the last three days and all they would come up with was "We are sorry. We DO NOT support this kind of questions". They claimed that "this is a specialized to Wordpress software rule", although we kept telling them it has nothing to do with Wordpress itself, but with the configuration of the server.

Anyway... Problem solved. :)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.