I noticed my apache system is delivering .htaccess files although it shouldn't, due to:

# The following lines prevent .htaccess and .htpasswd files from being
# viewed by Web clients.
<Files ~ "^\.ht">
    Order allow,deny
    Deny from all

which is the default Apache configuration. I have numerous virtual host below that. How can I find out why Apache still delivers .htaccess files?

Background: tried adding a Directory directive to block .svn folders and while wondering about why apache doesn't block them I came across that issue: It's not blocking anything at all, not even default .htaccess

mod_authz_host is loaded in /etc/apache2/mods-enabled/authz_host.load

LoadModule authz_host_module /usr/lib/apache2/modules/mod_authz_host.so
  • You likely have a higher precedence section, like a <Location>, allowing access to the files. Can you provide the simplest possible version of the "full" configuration, with other relevant server-wide sections and a virtualhost section? Oct 20, 2014 at 17:13

1 Answer 1


It should be:

<FilesMatch "^\.ht">
    Order allow,deny
    Deny from all

This requires mod_authz_host to be loaded with something similar to:

LoadModule authz_host_module    libexec/apache22/mod_authz_host.so
  • Same effect, added your code, restarted apache, it's still serving .htaccess files
    – Hokascha
    Oct 20, 2014 at 17:02
  • Do you have mod_authz_host still loaded?
    – Chris S
    Oct 20, 2014 at 17:05
  • I think so. At least it is loaded insinde /etc/apache2/mods-enabled/authz_host.load How can i verify?
    – Hokascha
    Oct 20, 2014 at 17:10
  • Is there another Files type directive in the configuration, or in a .htaccess file (particularly near the data root)?
    – Chris S
    Oct 20, 2014 at 17:15
  • yes, in global apache2.conf there is: <Files *> order deny,allow deny from deny from </Files> Removing the whole Files directive makes blocking .htaccess files work again. What's wrong with that second Files directive?
    – Hokascha
    Oct 20, 2014 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.