Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

PCI scanning reports the below issue for my Joomla site.

"It is possible to retrieve file backups from the remote web server"

I've checked it manually by accessing

Basically it does not throw 404 error while accessing

I want to throw 404 error or redirect to home page while accessing any directory using ~

So what i have tried is to add below line in my .htaccess

RewriteCond %{REQUEST_URI} ![~]$ [NC]

However this does not work.

Can any Joomla expert please advise if there is any other way to fix this or if above command is correct and where exactly should it be placed. I've tried putting this under root directory and under /joomla/components/mod_user directory.

share|improve this question
You can also tell your ASV that this is a false positive. They will verify and remove it as a fail item from the report. – Ladadadada Aug 10 '12 at 9:54
This is not false positive since accessing is displaying and not throwing 404 error code. I've also checked this myself. – Kesav Aug 10 '12 at 10:00
It is a false positive if you can't retrieve a backup version of your file at that URL. Emacs creates a file in the same directory where you are editing with the same name but with a tilde on the end. It uses this as a backup so you can revert to a previous version. If you don't use Emacs and the actual file doesn't exist, it's a false positive. – Ladadadada Aug 10 '12 at 10:03
This is a terrible question title. – womble Aug 10 '12 at 10:54
Am I the only one to be concerned that Kesav is processing credit card payments but doesn't know what's happenning here nor how to diagnose / resolve it? – symcbean Aug 10 '12 at 11:42

Why does everyone run straight to mod_rewrite? It's like trying to use an anti-ship mine to open a tight jar lid. Just use a LocationMatch to match whatever file paths you want, and then put a deny from all in there.

share|improve this answer
+ 1 for the use of anti-ship mines. – t1nt1n Aug 10 '12 at 11:59
Thanks for the responses. However i cannot make use of LocationMatch since it will not work using .htaccess. I'm on shared hosting, so i can only play around with .htaccess and not apache configs. Any other solution or workaround? – Kesav Aug 10 '12 at 18:42
Is it possible to obtain any level of PCI compliance on shared hosting? I would be surprised if it was. – Ladadadada Aug 10 '12 at 22:02
It's not impossible, but it requires a bit of cooperation from your shared hosting provider -- the sort of cooperation that would cause them to add a LocationMatch rule for you. – womble Aug 11 '12 at 11:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.