How can i block everything except root PHP scripts

Question

I want to block HTTP access to every file in my project directory except PHP scripts located in the root folder (not subfolders).

My current .htaccess file looks like this :

# Disable Directory Listings in this Directory and Subdirectories
# This will hide the files from the public unless they know direct URLs
Options -Indexes

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule ^api/(.*)$ api.php/$1 [QSA,L]
</IfModule>

# Deny all files from being accessed with Apache
Order Deny,Allow
Deny from all

# Allow specific PHP files at root
<FilesMatch "/(api|cron|status)\.php$">
    Order Allow,Deny
    Allow from all
</FilesMatch>

This mostly works, except for the URL rewriting on the api.php script. I've tried changing the FilesMatch regexp to /(api|cron|status)(\.php)?$, but it keeps on throwing me a 403 response.

Anyone can explain to me what I did wrong here ? I'm usually OK with regexp, but this has got me thinking Apache doesn't process them like everyone else...

user7858183 · Accepted Answer · 2017-04-12 18:40:08Z

1

Deny from all    

<FilesMatch "^(api|cron|status)\.php$">
 Order Allow,Deny
 Allow from all
</FilesMatch>

And I guess make sure your .htaccess is on the root level.

answered Apr 12, 2017 at 18:40

user7858183

361 bronze badge

Sign up to request clarification or add additional context in comments.

1 Comment

3rgo Over a year ago

Thanks it did the trick. I guess it was the leading slash causing the problem

Collectives™ on Stack Overflow

How can i block everything except root PHP scripts

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related