In order to secure my webserver, I would like to block specific file types from being uploaded globally, independent of what FTP users configure in their webpages.

Is there a way to globally block specific file types from being uploaded (such as PHP files) in Apache?

  • What do you want to prevent? execution of those files? is it an option to mount the target filesystem noexec?
    – dawud
    Mar 23, 2015 at 16:32
  • I would like to prevent visitors from uploading PHP (and other) files through PHP file upload. Mar 23, 2015 at 16:36
  • Again, PHP is plain text, what do you want to prevent? what would be allowed?
    – dawud
    Mar 23, 2015 at 16:54
  • PHP can access the mailserver and use it for spamming. Mar 23, 2015 at 17:42
  • 1
    Are you serving PHP on your Apache? If not, disable that module and also similars like cgi. If you do serve PHP, just do not allow your users to upload files to the DocumentRoot of your Apache. If you serve PHP and your users need to upload files to the DocumentRoot of your Apache... well, I'd go to force a text/plain response on the Apache for your users files.
    – NuTTyX
    Mar 23, 2015 at 19:57

2 Answers 2


I am unaware of anything that would stop uploads (if using sftp or something else), from Apache, though if using PHP for the uploads, then the file extensions can be disabled.

Likely there would be some setting in whatever SSH/FTP server one is using.

However, from Apache there are various ways of disabling execution of files from given directories, using things like FilesMatch / deny from all, or SetHandler / None. These could be in .htaccess files or in httpd.conf.

See https://stackoverflow.com/questions/5689423/how-to-ban-all-executable-files-on-apache for a similar discussion.


I'm pretty sure you can accomplish this using mod_security's SecRule FILES directive. Check out http://sourceforge.net/p/mod-security/mailman/message/18919856/ or the top of https://gist.github.com/nopslider/452b652850cf359c3738 for two different examples.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .