: Configuring directory access on a server. .htaccess and alternatives? I have written a small PHP package/site-template (should I say). It contains a directory data/ that contains some important

@Shanna517

Yes, you can do this with .htaccess:

Order deny,allow
Deny from all


If you want a portable way to do this, just put the sensitive data outside of your docroot. This is the preferred way to store things like database credentials, temp files/session data, and other things you want to control access to (such as downloadable products if you're selling MP3s or ebooks online).

Edit:

.htaccess is available for nginx, I believe, but it's apparently discouraged.

And, I believe, it's possible to protect the directory using file system permissions if the server is configured to run PHP using suexec. In which case, you ought to be able to set the directory to 400 to allow PHP to read the directory, but not allow direct access by users.

Vote Up Vote Down