Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On my webserver I would like to block all files except some reasonable exceptions. I have following Filesmatch directive which is doing it's work:

<FilesMatch "(?<!\.txt|\.htm|\.html|\.css|\.php|\.js|\.jpg|\.png|\.gif|\.ico|\.svg|\.eot|\.ttf|\.woff|\.otf)$">
    Order Allow,Deny
    Deny from All

Note this FilesMatch uses a negative lookbehind regular expression: see It will block all files except those having an extension as stated.

This results also in an 403 Forbidden for the directory default document (index.html). This is not what I want. Can someone help? How does the default document lookup work? Is there another solution to blocking all except some? I looked in Apache2's error log with LogLevel debug, but the only message is "client denied by server configuration" when asking for a default document. (Explicitly asking for the index.html works)

Edit: there is a solution to this by using the Location directive. See Using FilesMatch to increase security So my problem is solved, but I still would like to know why it does not work with FilesMatch.

share|improve this question
Why do you expect .html not to block index.html ? – gparent May 20 '13 at 19:40
Why do you have files in that directory, if you don't want people to be able to get them?? – Chris S May 20 '13 at 19:41
I added some info: the filesmatch directive here is not blocking files ending on .html. And the intention is indeed to show the files with extensions specified, nothing else. – user906489 May 20 '13 at 19:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.