htaccess restrict access to index.php only

Question

I was writing a .htaccess file for my PHP script.
This should only allow access to the index.php, cronjob.php and execute.php pages.
I wrote the .htaccess file as follows:

# Set default index file
DirectoryIndex index.php

# Disable indexing
Options -Indexes

# Set "403 Forbidden" as the default server behavior
Order Deny,Allow
Deny from all

# Allow requests to core PHP files
<FilesMatch "(index|execute|cronjob)\.php$">
    Allow from all
</FilesMatch>

# If mod_rewrite module exists...
<IfModule mod_rewrite.c>
    RewriteEngine On
    
    # ...restrict access to PHP private directories
    RewriteRule (^|/)logs(/|$) - [F]
    RewriteRule (^|/)utils(/|$) - [F]
    RewriteRule (^|/)modules(/|$) - [F]
</IfModule>

The main problem with this code is that https://example.com/ returns 403 Forbidden,
while https://example.com/index.php works.

RavinderSingh13 · Accepted Answer · 2021-01-01 04:17:34Z

1

You could put condition to check if a URI is NOT having either index.php OR cronjob.php or execute.php then forbid that page so else other pages will be forbid apart from these 3 php uris.

Please make sure you clear your browser cache before checking your URLs.

RewriteEngine ON
RewriteCond %{REQUEST_URI} !(index|cronjob|execute)\.php [NC]
RewriteRule ^ - [F]

edited Jan 1, 2021 at 4:17

answered Jan 1, 2021 at 3:39

RavinderSingh13

135k14 gold badges61 silver badges100 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Giuseppe · Accepted Answer · 2021-01-01 12:26:29Z

0

In the end I managed to get it to work, I don't know if it's the best .htaccess possible, but this is what I ended up with:

# Set default index file
DirectoryIndex index.php

# Disable indexing
Options -Indexes

# Set "403 Forbidden" as the default server behavior
Order Deny,Allow
Deny from all

# Allow requests to core PHP files
<FilesMatch "^((index|execute|cronjob)\.php)?$">  # Basically, it accepts the three PHP files and the empty string.
    Allow from all
</FilesMatch>

answered Jan 1, 2021 at 12:26

Giuseppe

5501 gold badge6 silver badges23 bronze badges

2 Comments

RavinderSingh13 Over a year ago

HI, thanks for sharing, so my answer didn't help you? I tested it and it worked fine, could you please do let me know on same.

Giuseppe Over a year ago

@RavinderSingh13 Yes, it does. I read it after writing mine. Thanks anyway.

Collectives™ on Stack Overflow

htaccess restrict access to index.php only

2 Answers 2

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related