Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a repository of files with .php, .sh, and .txt extensions which gets checked out to the web directory of my server (/var/www). I need the .php files to be able to be reached by typing in a url but I want the .sh and .txt files only to be accessible internally -- meaning they can be read and run by php or a cron but never by a user typing in their url. How can I do this on apache? Do I need to set the permissions of the files to something or mess with the .htaccess or do something else?

share|improve this question
up vote 3 down vote accepted

The correct way of doing this is by moving the files out of your document root -- you're just a configuration failure away from data leakage, which is never a fun place to be. Look at any modern web application framework for an example and execution.

However, to do this in Apache you just use a LocationMatch directive in the appropriate context:

<LocationMatch \.sh$>
    order deny,allow
    deny from all
share|improve this answer
Ok thank you. The reason it wasn't like to begin with was it was part of a repository which I had to checkout to the web directory but maybe there is a way around this too... I also found that I can change the premission for 'others' and it can still run the shell scripts but not show them. – hackartist Jul 14 '12 at 21:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.