I have a repository of files with .php, .sh, and .txt extensions which gets checked out to the web directory of my server (/var/www). I need the .php files to be able to be reached by typing in a url but I want the .sh and .txt files only to be accessible internally -- meaning they can be read and run by php or a cron but never by a user typing in their url. How can I do this on apache? Do I need to set the permissions of the files to something or mess with the .htaccess or do something else?
The correct way of doing this is by moving the files out of your document root -- you're just a configuration failure away from data leakage, which is never a fun place to be. Look at any modern web application framework for an example and execution.
However, to do this in Apache you just use a