Forbid Directory Access with htaccess

Not just password protect

[neophyte]

Hello All -

I use htaccess on a very limited basis now, but what I need to do with a current project is to FORBID access to a bunch of specific directories located within the root of the site. I don't want these directories password-protected, I need them to be completely hidden from URL access as they contain sensitive PHP functions for this particular project.

You know, sometimes you go to a url and you get the message "Forbidden Directory" or some such message. That's what I need, but don't know the htaccess syntax to use for these directories.

Can someone please assist me?

Thanks to all in advance!

Neophyte

[jdMorgan]

Use a <Files> or <FilesMatch> container (see Apache core [httpd.apache.org]) and include "Deny from All" (see Apache mod_access [httpd.apache.org]) inside it.

Jim

[neophyte]

Jim -

Thanks for your reply - thanks also to phranque for moving this post to a more appropriate forum.

Jim... I suppose I could use FilesMatch with the .php extension but I was kind of hoping to lock out entire folders of files at one go. Then I saw the <Directory /> link. Could I not forbid entry into any named directory by doing something like the below?

<Directory />
*this directory*,*that directory*,*some other directory*
Deny from All
</Directory>

I'm sure my syntax isn't correct, but if this would work, it would seem like the path of least resistance.

Appreciate your continued input,

Neophyte

[jdMorgan]

You can use <Directory> in the httpd.conf or conf.d server configuration files, but not in .htaccess -- Note the "Context" given for each Apache directive in the documentation. If you have server config privileges, then <Direcory> or <Location> would be the way to go.

Otherwise, use <Files *> in .htaccess files within the directories you want forbidden to deny access to all files within those directories.

Jim

[g1smd]

This works for me:

RewriteRule ^includes /this.file.does.not.exist
RewriteRule ^errors /this.file.does.not.exist

Any externally requested URL located in those folders serves a 404.