Skip to main content

.htaccess Directory Access

Directory Access

This directive will prevent access to directories that don't have an index file present in whatever format the server is configured to use, like index.html, or index.php.

<IfModule mod_autoindex.c>
Options -Indexes

Block access to hidden files and directories

In Linux and Machintosh systems, files that begin with a dot are hidden from view but not from access if one knows their name and location. These types of files usually contain user preferences or the stored state of a utility, and can include rather private places like, for example, the .git or .svn directories.

The .well-known/ directory represents the standard (RFC 5785) path prefix for "well-known locations" (e.g.: /.well-known/manifest.json, /.well-known/keybase.txt), and therefore, access to its visible content should not be blocked.

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} "!(^|/)\.well-known/([^./]+./?)+$" [NC]
RewriteCond %{SCRIPT_FILENAME} -d [OR]
RewriteCond %{SCRIPT_FILENAME} -f
RewriteRule "(^|/)\." - [F]

Block access to files with sensitive information

Block access to backup and source files that may be left by some text editors and can pose a security risk when anyone has access to them.

You can use the <FilesMatch> regular expression (see example below) to protect any files that might end up on your production server and can expose sensitive information about your website. These files may include: configuration files or files that contain metadata about the project among others.

<IfModule mod_authz_core.c>
<FilesMatch "(^#.*#|\.(bak|conf|dist|fla|in[ci]|log|orig|psd|sh|sql|sw[op])|~)$">
Require all denied