Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I say, "if the file is in the /wp-content/* directory, serve it as long as it's .+\.(jpe?g|gif|png|js|css)$, otherwise throw a [F]orbidden."

I can't seem to wrap my head around where to begin.

I'm okay with regex, but my mod-rewrite skills are (obviously) lacking.

share|improve this question
Both answers by serverninja and Born To Ride are correct, but note that the code should be %{REQUEST_URI}, not {%REQUEST_URI}. – Jeff Nov 5 '09 at 15:08
up vote 2 down vote accepted

Something like this:

RewriteEngine On
RewriteOptions Inherit

RewriteCond %{REQUEST_URI} ^/wp-content/.*
RewriteCond %{REQUEST_URI} !.+\.(jpe?g|gif|png|css|js)$
RewriteRule ^/(.*)$ - [F]

I'm not at a machine where I can test it, but the idea here is two conditions that check for the wp-content directory in the URI, and then a negated condition for the files you want to serve statically. Everything else should put out a 403 error. If it's not right, it will certainly point you in the right direction ;-)

edit: syntax should be %{} not {%} -- thanks Jeff!

share|improve this answer
Thank YOU for the help. =) – Jeff Nov 5 '09 at 19:25

A more compact version of serverninja's snippet would be the following:

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond {%REQUEST_URI} !^/wp-content/.*\.(jpe?g|gif|png|css|js)
  RewriteRule ^.*$ - [F]
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.