Using .htaccess to restrict access to Files and Directories

Apache allows access to everything inside the Document Root folder by default. This means all the sub directories and their contents can be listed and accessed. However you can use .htaccess to harden the security of your Apache Server. The .htaccess is a configuration file, which if detected will be executed by Apache.


If you already have a .htaccess file in your Document Root Folder, back it up before making any changes. Edit or create a new .htaccess file.

Three most important security settings you should consider adding to your .htaccess file are:

1. Deny Access to .htaccess Itself

Add the following lines in your .htaccess file to prevent access to .htaccess file itself.

2. Disable Directory Indexing

The following line in .htaccess will remove directory indexing and make the server respond with a 403 forbidden message.

To simply hide all the contents of the directory without forbidden message, use the IndexIgnore directive.

To hide some filetypes only, use

3. Prevent access to certain files

Even if you remove directories and files from listing, they are still accessible if you type the path.

To remove unauthorized access to cetain file extensions, use

To prevent access to all filenames starting with dot(.) like .htaccess, .htpasswd, .env and others use

You may also password protect files and directories and store the passwords in a .htpasswd file

Replace the <Full Server Path to .htpasswd file> with your actual path.

You may also place .htaccess file inside each sub-directory with specific over-rides. The access rules can be directly defined inside Apache’s main configuration file httpd.conf. But if you don’t have access to the main configuration file (which is normally the case if your using a shared hosting service), you have to resort to .htaccess based access rules.

Note: Over-riding httpd.conf settings using .htaccess is only allowed if the AllowOverride Directive is set inside httpd.conf which is the default case.

Prakash S

Prakash S

I would like to introduce myself as a Software professional opting for the career in software industry. I'm Prakash S, a MCA graduate and trained as industry level practice for Software technology. Basically I am a PHP Developer but now days exploring more in HTML5, CSS, AngularJS and jQuery libraries.