According to Apache documentation, setting the AllowOverride and AllowOverrideList options to None, will completely ignore .htaccess files. Not even attempt to read them from the filesystem.

I have both of those options set to none but Apache still reads the .htaccess files. I know this because if I put a .htaccess file in with some valid directives it throws a 500 error. Commenting out the directives (essentially an empty .htaccess file) the 500 error is not thrown. So obviously Apache is still reading the .htaccess files.

Apache2 error log (sanitized for public consumption):
[Thu Jul 30 23:36:35.393831 2020] [core:alert] [pid 60903] [client d.d.d.d:10554] /var/www/example/.htaccess: Require not allowed here, referer: http://example.net/

The question is why? What am I missing? How to make it behave according to the documentation? i.e. not even attempt to read the .htaccess files.

Reference: https://httpd.apache.org/docs/2.4/mod/core.html#allowoverride

When this directive is set to None and AllowOverrideList is set to None, .htaccess files are completely ignored. In this case, the server will not even attempt to read .htaccess files in the filesystem.

  • What does the Apache2 error log show when it throws the 500 error? Jul 31, 2020 at 7:37
  • Showing the config file might be useful.
    – tater
    Jul 31, 2020 at 7:47
  • Apache2 error log shows Sanitized for public consumption... [Thu Jul 30 23:36:35.393831 2020] [core:alert] [pid 60903] [client d.d.d.d:10554] /var/www/example/.htaccess: Require not allowed here, referer: example.net
    – NOYB
    Jul 31, 2020 at 7:47
  • 1
    What version of Apache 2.4 are you using?
    – MrWhite
    Jul 31, 2020 at 10:23
  • 1
    Apache/2.4.6 (CentOS) built: Apr 2 2020
    – NOYB
    Jul 31, 2020 at 12:05

1 Answer 1


This would appear to be a bug in earlier versions of Apache 2.4 that was reportedly fixed in Apache 2.4.20

The bug would seem to be that when explicitly setting AllowOverrideList None the value is not being correctly reset.

I have verified that I see the same (incorrect) behaviour in Apache 2.4.7

If you have never set AllowOverrideList elsewhere in your server config then you can omit this directive, since the default is None. (When left as default it does appear to be correctly interpreted as per the docs.)

  • 1
    Thanks so much MrWhite. This indeed is the problem. Now there is no more .htaccess access. :)
    – NOYB
    Jul 31, 2020 at 12:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .