protect ALL htaccess files from public view

[compooter]

# Ban access to files & file extensions
RewriteRule ^\.htaccess$ - [F]
RewriteRule ^\.htpasswd$ - [F]

My intentions are to ban access to all .ht(access/passwd) files, but this only works for the root directory. How would you modify this to include all subdirectory .ht(access/passwd) files as well?

..a

[Robert Thivierge]

When I installed Apache the following was already in "httpd.conf" and works fine:

# The following lines prevent .htaccess and .htpasswd files from being
# viewed by Web clients.
#
<Files ~ "^\.ht">
Order allow,deny
Deny from all
</Files>

As for your ".htaccess" code:

RewriteRule ^\.htaccess$ - [F]
RewriteRule ^\.htpasswd$ - [F]

The "^" is forcing the comparison to start at the extreme left edge of the string. Maybe try dropping it.

[compooter]

ah yes. the infamous ^

thanks!

[jdMorgan]

Be aware that <Files> also means "only files". That is, the string inside <Files> is compared only to a filename, not to a file-path. Therefore, you use the start anchor in <Files> but not in RewriteRule. <Files> ignores directory-path info, while RewriteRule does not, since it works with URLs.

It's a subtle, but important difference.

Jim

[compooter]

Yes & thanks for the advice!

I decided to go the mod_rewrite method because I have other rules that rewrite [domain.com...] >> [domain.com...]

That in conjunction with errordocument was resulting in rewriting the path to my errordocument to the address bar. Since I'm using error.php?404 or error.php?403 etc I thought it best just to force 403 so that the inner-workings of my errordocuments stays hidden in the event that someone asks for [domain.com...]

..a