Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running Apache 2.2.20 on a Ubuntu 11.04 web server. I have a Joomla site running on it, but I have also added some custom content. In the main web directly I have added a folder /images/sub_folder and in this sub_folder I have put a bunch of pictures. I do not want anyone to be able to simply access these pictures directly from the web, so I made a .htaccess file in that sub_folder and just put the following line in it:

deny from all

There doesn't seem to be any effect, I can still access the images directly from a web browser. I have restarted the Apache service. What am I doing wrong?



share|improve this question
up vote 2 down vote accepted

At your apache configuration deny the entry for the directory, something like this:

<Directory "yourdirectoryabsolutepath" >
Options Includes
AllowOverride All
Order allow,deny
Deny from All

If you want to ask for a login password to access to the folder from web uou need to create an .htaccess in the folder you want to protect, and a password file for the user that will be able to log in, but have to change from your apache config to Allow from All and something at your .htacces like this

AuthName "Password Protected Directory"
AuthType Basic
AuthUserFile /pathtoyourpasswdfile/.htpasswd
require valid-user

and use a site like this to create your encrypted password, same format that your apache uses

And thats it, now that when you need to enter to the folder a promp will show and ask you for the user and password. Might need to restart apache

share|improve this answer
Good note about setting up authentication in context of the question. – Sachin Divekar Sep 7 '12 at 20:04
Yes!!! that did. – jeffery_the_wind Sep 7 '12 at 20:17
you are welcome... – jpganz18 Sep 7 '12 at 20:56

In your website's config file, you will have to use AllowOverride All. This will override earlier configuration directives with whatever you have mentioned in .htaccess file.

Note: For security reasons, do not set AllowOverride to anything other than None in your block. Instead, find (or create) the block that refers to the directory where you're actually planning to place a .htaccess file.

Refer following links.

share|improve this answer
Thank you for the help. – jeffery_the_wind Sep 7 '12 at 20:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.