How to block access to certain file types using .htaccess

It’s a good practice to block visitor access to file types that is not being used in web server. You can configure .htaccess to block access to specific file types (eg: inc, bak, log, sh). It’s common for webmaster to edit files at the server and rename the old filename to .bak. If your file contain sensitive information like login credentials, then your info will be expose to public.

To block access to certain file types using .htaccess, follow the steps below:

• Open your .htaccess file
• Copy and append the following code to your .htaccess:-

  <Files ~ "\.inc$">
  Order allow,deny
  Deny from all
  </Files>
  

  * The method show above only block access to 1 file type (.inc) at a time

  If you want to block access to multiple file types at once, use the code below:-

  <FilesMatch "\.(htaccess|htpasswd|ini|log|sh|inc|bak)$">
  Order Allow,Deny
  Deny from all
  </FilesMatch>
  

  * the code above block access to .htaccess, .htpasswd, .ini, .log, .sh, .inc and .bak file extension.

• Save your .htaccess and try to access any a fake filename that ended with the extension listed above. You should see a “Forbidden” message

Tags: .htaccess, block access to file extension, block access to file extension .htaccess, block access to file types, htaccess block access to file types

Posted at January 26th, 2010 by chua

If you think this article helps you to solve your problem and clear your headache, feel free to buy me a drink :)