Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have this very big problem I've been trying to solve for last few days with no success. I have some files which are class schedules, these are imported to the server from an external source (html format). I need to block direct access to those files. They are displayed by PHP script. So, these are assumptions: -files displayed via php script -files cannot be modified in any way (html files) -there must be no direct access to those files -server is apache

any ideas? I tried with htaccess, but I may be not competent enough, because it was blocking access to files for php script too.

Thanks in advance.

share|improve this question

migrated from Oct 4 '12 at 23:43

This question came from our site for professional and enthusiast programmers.

I think another way is :

  1. create a key-value table, rename the file, the old name is key and the value is the new one(may be md5('xx') or other long/irregular/unique string) .
  2. lookup the 'key-value' table when access the files.
share|improve this answer
up vote 0 down vote accepted

use .htaccess

Sample RewriteRule

RewriteEngine on
RewriteRule ^folder/$ http://path_to_different_page.php 
share|improve this answer
thanks everyone and especially You, it is the simpliest and the most efficient way I think :) – user1515145 Oct 4 '12 at 17:25
you are most welcome – Champ Oct 4 '12 at 17:28

files displayed via php script

Store the passwords somewhere (securely). HTML form to submit credentials. $_POST to read them. PDO to read them. include to include the files if the user is authorised.

-files cannot be modified in any way (html files)

All the logic goes in PHP. All the credentials are stored externally.

-there must be no direct access to those files

Keep the files outside the DocumentRoot.

share|improve this answer

if you are asking for one or more files protection using .htaccess then you could do something like below ...

AuthName "Restricted Area" 
AuthType Basic 
AuthUserFile /path/to/passwordfile/.htpasswd 
AuthGroupFile /dev/null 
<Files admin.php>
require valid-user
<Files protected.htm>
require valid-user
<Files protected2.htm>
require valid-user

You'll need to create one .htpasswd file too and update the AuthUserFile path to location of this file .... There is a tool availabe at to create these .htaccess and .htpasswd files.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.