Forum Moderators: phranque
<FilesMatch "\.(inc¦cfg¦pwd¦fcn¦rsrc¦tmp¦js¦css¦cron¦bck¦bld¦xml¦mnu)\.php$">
Order Deny,Allow
Deny from All
</FilesMatch>
Jim
Have you made other recent changes?
Is there another "Order" statement in your config? (Only the last one is applied in .htaccess in some cases)
FilesMatch means "files" so it does not care what directory the file is in -- this directory, or any directory below it, or what URL was used to reach it.
Deny,Allow means that any Allow in an equally- or more-widely-scoped container can override the Deny. So be careful about both the Order [httpd.apache.org] that you select and the scoping of the Denys and Allows. If that's too complex, or if you don't need the scoping behaviour, you can always just use a RewriteRule with an [F] flag to unconditionally deny access to the URL-paths corresponding to those files:
RewriteRule \.(inc¦cfg¦pwd¦fcn¦rsrc¦tmp¦js¦css¦cron¦bck¦bld¦xml¦mnu)\.php$ - [F]
If not, your browser will happily show you previously-cached copies, unless the files' cache-controls prohibit this (check the server response headers).
You can verify that this is happening by looking at the raw server access logs: Either you won't see your own requests for these files at all, or you'll see a 304-Not Modified response or a 200-OK response with a transfer byte count of zero.
Jim
Jim
