.htaccess to restrict access to folder

If you don’t have the option of actually moving the “includes” folder outside of the Document Root area, and using the include_path (i.e. you can’t get to it from web), then enter

deny from all

in a .htaccess directory in that directory.

However, alternative is to use a DEFINES directive to only allow access to those include programs by specific authorised files. For example, put

<?php defined('ACCESS_ALLOWED') or die('Restricted Access'); ?>

in the top of the include files, and then put

<?php define('ACCESS_ALLOWED', 1); ?>

in the programs that are allowed to include those files.

This will prevent casual GETs to those include files from running them, and will work for any web server, not just those supporting htaccess files.

Leave a Comment