Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Due to circumstances beyond my control, I must include sensitive information (database password) in a web-accessible directory. Furthermore, this host has already had a configuration issue in which .php files were served without parsing.

Which files will Apache under no circumstances ever serve from within the web root, even in the event of misconfiguration. Casual googling leads me to believe that any file that begins with the string .ht will never be served, but as I have no way of testing this I'd like the opinion of those more familiar with the subject than I.

Note that moving to a different server / host is not an option. Sometimes we don't live in a perfect world and must do with what we have.

share|improve this question
Apache won't serve any file you tell it not to serve. –  Michael Hampton Sep 27 '12 at 1:31
I understand that .htaccess could be used to deny certain files. However, I would like to know if there is something a bit more robust, that won't serve the files even if the server admin screws up the configuration again (disables .htaccess for instance). I have seen reference that files starting with .ht will never be served, but as I cannot simulate the failure I'd like the advice of those with more Apache experience. Unfortunately putting the sensitive file outside the webroot is not an option. –  dotancohen Sep 27 '12 at 5:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.