I need to deny direct access to all folders under a certain directory (*backend) with one exception. There is one directory (*uploads) that has to be accessible through the browser.

The layout could be something like this:


I know you can deny all access by placing an htaccess under backend with the following:

Order Deny,Allow
Deny From All

Also, that you can override this behavior by placing a different htaccess, in this case under uploads, with:

Allow From All

This is not working, since assets under themes are not accessible to my scripts. What would be the right htaccess combo look like?


I have to achieve this with htaccess, modifying the http.conf is not an option.

Modifying the htaccess such as follows, and adding one file to themes, almost has the desired result. The issue is that: files under themes have to be protected against direct access yet remain available to be served to the website.


Order Deny,Allow
Deny from all
Allow from
Allow from xx.xx.xx.xx


Order Deny,Allow
Allow from all


Order Deny,Allow
Deny from all
Allow from
Allow from xx.xx.xx.xx
<Files *.*>
    Order Deny,Allow
    Allow From All #Here, I would need the files to not be accessible through browser.

Try this in your httpd.conf (or similar configuration file)

<Location /backend>
    Order deny,allow
    deny from all

<Location /backend/uploads>
    Order allow,deny
    allow from all

In case you need access to /backend from your server itself you could additionally add the following line in the first paragraph above deny from all.

allow from, <server-ext-ip>

One more thing. The order of the paragraphs is important, just in case.

  • This is basically the same setup I had, except that would be placed in the httpd.conf. The IP line was helpful, thou. You got an up-vote, thanks. – goliatone Dec 6 '11 at 12:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.