Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running a WSGI application written in Python with flask on Apache. I have so far configured my vhost correctly to use my application.

<VirtualHost *:80>

ErrorLog /var/www/abizeitung/error.log
LogLevel warn
CustomLog /var/www/abizeitung/access.log combined

WSGIDaemonProcess abizeitung user=www-data group=www-data threads=5
WSGIScriptAlias / /var/www/abizeitung/abizeitung.wsgi

<Directory /var/www/abizeitung>
    WSGIProcessGroup abizeitung
    WSGIApplicationGroup %{GLOBAL}
    Order deny,allow
    Allow from all

My problem is that I'm able to view the source e.g. "localhost/abizeitung/". Just changing "Allow from all" to "Deny from all" blocks all access to the application.

share|improve this question

You could setup a deny rule based on <FileType>, or you could configure your document root to point somewhere else. You only need the document root for your static content. And, if you define a Alias like `Alias /static /var/www/abizeitung/static' (or wherever your static is), you don't even need a document root.

BTW, why is:

WSGIProcessGroup abizeitung
WSGIApplicationGroup %{GLOBAL}

In your <Directory> block?

share|improve this answer
In other words, never stick your Python web application source code under the directory that DocumentRoot for the server points at. So move your source code out of /var/www/abizeitung. – Graham Dumpleton Sep 12 '13 at 21:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.