Apache Hide Specific File Types from Web

Question

I have a repository of files with .php, .sh, and .txt extensions which gets checked out to the web directory of my server (/var/www). I need the .php files to be able to be reached by typing in a url but I want the .sh and .txt files only to be accessible internally -- meaning they can be read and run by php or a cron but never by a user typing in their url. How can I do this on apache? Do I need to set the permissions of the files to something or mess with the .htaccess or do something else?

Answer 1

The correct way of doing this is by moving the files out of your document root -- you're just a configuration failure away from data leakage, which is never a fun place to be. Look at any modern web application framework for an example and execution.

However, to do this in Apache you just use a LocationMatch directive in the appropriate context:

<LocationMatch \.sh$>
    order deny,allow
    deny from all
</Location>