We have a .htaccess file in a folder configured with deny,allow as follows:

Order deny,allow
Deny from all
Allow from <whitelist IP>
Allow from <whitelist IP>

There are no other rewrite etc. rules in this file, just the deny/allow stuff.

If you attempt to go to http://www.xyz.site/protected/ (no filename) from a denied IP, you get the Forbidden error as expected. If, however, you go to http://www.xyz.site/protected/filename.php - where filename.php is a valid file inside the folder, e.g. the login form, the page loads - but with no images or CSS (presumably still denied per the .htaccess)

Why isn't this .htaccess setup preventing access to the whole folder from denied IPs - might there be a conflicting server permission somewhere overriding it?


It really depends on your configuration. How is the php interpreter invoked? You are using it via CGI, FastCGI or are you using the embedded php interpreter, aka mod_php?

  • FastCGI. We've got a .htaccess file in the parent folder to our protected one which contains a line to stop RewriteRules taking effect in the folder: RewriteRule ^protected/(.*) - [L] Could this be interfering with the deny/allow logic? I'm also risking the wrath of the mods by mentioning this, I suspect, but the server is also running Plesk 10.4.4..... – MikkyX Nov 11 '15 at 14:04
  • Then probably apache is configured to forward all the .php requests to the fastgci interpreter before parsing the .htaccess file... – SimoneLazzaris Nov 11 '15 at 15:26

Sounds like that .htaccess content is not being interpreted and the "Forbidden" result on accessing the directory comes from forbidden DirectoryListings (non-existing index-file?).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.