Forum Moderators: phranque

Message Too Old, No Replies

Avoid Guest access from /images

         

timehri

9:06 pm on Feb 15, 2009 (gmt 0)

10+ Year Member



i have a web server running apache2. i just realize that when i enter "www.mydomain.com/images" i can get access to "index of images folder" which list all my images.

how can i avoid visitors from getting access to this folder.

This is where i keep all my images , pics etc.

jdMorgan

9:18 pm on Feb 15, 2009 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



See Apache core Options -Indexes

Jim

timehri

10:02 pm on Feb 15, 2009 (gmt 0)

10+ Year Member



Oh I forget to tell you that i am very new into this server business and that this is my first PERSONAL server, so be patient with me.

Actually the full link to the picture is "www.mydomain.com/images/mybirthday/pic1.jpg", however if I omit "mybirthday/pic1" and just type in on the address bar "www.mydomain.com/images" i get a list of all files stored in my Images directory, which i have files that i don't want my visitors to view(ie who knows how to get it)

Thank you.

londrum

10:05 pm on Feb 15, 2009 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



you can also just put a blank index.html in the images folder, and that will stop the list from appearing

timehri

11:32 pm on Feb 15, 2009 (gmt 0)

10+ Year Member



thanks londrum, that was agreat idea. it did worked.

So i will have to do that for all directories created in "images"

Good solution.

jdMorgan

2:19 am on Feb 16, 2009 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



If you have an .htaccess file on your site at example.com/.htaccess, just add the line:
 Options -Indexes 

to it.

That will deny access to "directory indexes" without having to add blank or 'fake' index files to all directories that don't have an index page in them.

If you don't have an existing .htaccess file, you can create one. .htaccess files are plain text files, so use an "ASCII editor" like Notepad on Windows, and not a word-processor program or HTML editor.

If you are using a Windows PC to create the file, you will have to name the file "htaccess.txt" (or similar) on the PC, and then rename it to ".htaccess" after you upload it using FTP.

Note that with some FTP clients, system files having names beginning with a period are hidden, so the file may "disappear" from view. If this is the case, most FTP clients can be adjusted to show system files. The method varies -- Just look around in the "options" for your FTP client program. Some may be obvious, like "Show system files" while others may contain only a cryptic reference to "List command". In this latter case, setting the list command to "ls -a" or "ls -al" should work.

Jim

timehri

2:41 am on Feb 16, 2009 (gmt 0)

10+ Year Member



Sounds like a good idea.

Question is where do u place this .htaccess file within apache?

jdMorgan

1:16 pm on Feb 16, 2009 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



See first line of my post above...

Jim

coopster

1:58 pm on Feb 16, 2009 (gmt 0)

WebmasterWorld Administrator 10+ Year Member



Welcome to WebmasterWorld, timehri.

As has been mentioned, you will want to refer to the Apache docs [httpd.apache.org] themselves. There are some notes in the default Apache *.conf files but one of your primary resources will be the Apache documentation itself. You likely have a copy of it installed with your server but you can always go online to read too.