
A website is made up from several folders which contain files such as style sheets and server sided code. By default these files and folders can be accessed via a browser leaving whatever contents in those folder open to prying eyes.
Lets say we have the following folder structure. (This is not the typical structure that I would use myself but is a good enough example). If a browser was pointed at www.site.com/css/ the user would see the code in a text format.
You may think that leaving you style sheet directory open isn’t much of a big risk to your site but what about your /cmd/inc folder. This could hold php files that contain database access details or the /img directory may be a family photo album. Is it a risk now?
Closing the door to all
To deny direct access to your folders all that is needed is a .htaccess file and three words…. “Deny from all”
Simply create a .htaccess file in the folder you want to lock down and add the following to it:
-
# Deny access from all
-
deny from all
-
Now if you try and access that folder via a browser you will get a forbidden warning and a 404 error will executed.
Leaving it open to a selected few
You may wish to allow relatives access to your photo albums in your/img directory but still keep it closed to everyone else. In order to achieve this you will need to know the IP address of the machines that you want to allow access too. Once you have these details modify your .htaccess file to look like this:
-
# Deny access from all except uncle Ronny
-
order deny,allow
-
deny from all
-
# Exception for uncle Ronny
-
allow from
-
# Where is an ip in the format of 00.00.0.0
-
Tarting up the 404 page
When a user tries to access a forbidden directory they will redirected to a 404 page. This looks a bit ugly and not very professional. In my previous post (htaccess error pages) I have discussed how to use htaccess to redirect certain error pages to nicely formatted pages which can consist of server and client sided code.
Conclusion
I hope you will agree it doesn’t take to much effort to secure your folders. If you have loads of directory’s that you want to keep private you could link them symbolically to a htaccess file outside of the root folder. But remember that all the linked htaccess files will have the same settings so I would only do this if you don’t want to allow any exceptions.
Share
These icons link to social bookmarking sites where readers can share and discover new web pages.