Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a bunch of files that are secure_xxxxxx.php. Is there a way to use .htaccess to block access to all the secure_* php files based on IP?

EDIT: I've tried but I get 500 errors

<FilesMatch "^secure_.*\.php$">
order deny all
deny from all
allow from my ip here

Don't see any errors in apache error logs either

httpd -M
Loaded Modules:
 core_module (static)
 authn_file_module (static)
 authn_default_module (static)
 authz_host_module (static)
 authz_groupfile_module (static)
 authz_user_module (static)
 authz_default_module (static)
 auth_basic_module (static)
 include_module (static)
 filter_module (static)
 log_config_module (static)
 logio_module (static)
 env_module (static)
 expires_module (static)
 headers_module (static)
 setenvif_module (static)
 version_module (static)
 proxy_module (static)
 proxy_connect_module (static)
 proxy_ftp_module (static)
 proxy_http_module (static)
 proxy_scgi_module (static)
 proxy_ajp_module (static)
 proxy_balancer_module (static)
 ssl_module (static)
 mpm_prefork_module (static)
 http_module (static)
 mime_module (static)
 dav_module (static)
 status_module (static)
 autoindex_module (static)
 asis_module (static)
 info_module (static)
 suexec_module (static)
 cgi_module (static)
 dav_fs_module (static)
 negotiation_module (static)
 dir_module (static)
 actions_module (static)
 userdir_module (static)
 alias_module (static)
 rewrite_module (static)
 so_module (static)
 fastinclude_module (shared)
 auth_passthrough_module (shared)
 bwlimited_module (shared)
 frontpage_module (shared)
 suphp_module (shared)
Syntax OK

Files seem to work fine.

share|improve this question
yes, you can at least make a rewrite rule based on ip. – user130370 Oct 25 '12 at 16:40
Any examples? So far I've had 500 errors. – Tiffany Walker Oct 25 '12 at 19:25
up vote 2 down vote accepted

You should be able to use the Files directive and mod_authz_host to achieve you goals.

For example:

<Files "secure_*.php">

See the references below.

Or using FilesMatch and the older ACL syntax:

<FilesMatch "^secure_.*\.php$">
    Order Deny,Allow
    Deny from all
    Allow from

This should only allow access from localhost.

share|improve this answer
Does it require PHP to be a certain mode? I got a 500 error with it – Tiffany Walker Oct 25 '12 at 19:24
FilesMatch is what I would want to use maybe? – Tiffany Walker Oct 25 '12 at 19:30
FilesMatch works, too. It's necessary if you want to use regular experessions in your match. PHP shouldn't be an issue here. If you are using an older version of Apache, you may need to use "allow" and "deny" instead of require. Check your Apache error log for more info. – slaptijack Oct 25 '12 at 19:34
Yea, I was using allow/deny but still 500'd on me. Appache is 2.2.23 – Tiffany Walker Oct 25 '12 at 19:37
I recommend updating your original question with the content of your .htaccess file and any relevant error messages from Apache's error log. – slaptijack Oct 25 '12 at 19:51

Yes, I think it's possible by using regular expression in .htaccess

and also limitation based on IPs using allow and deny options.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.