.htaccess allow access to files only from includes

Question

I have various subfolders on my website and I would like for the user not to be able to access them through URL but on the same time my main PHP files to be able to include them or use them as actions on forms or links.

I tried using an .htaccess with

<Files *>
    Order Allow,Deny
    Deny from All
</Files>

but it denied all access even from within my own scripts. Logical as I found out, but I cannot know how to make it work. Any ideas?

P.S. My main concern is that some of the files are not included in main PHP files BUT they are linked there and their code ends up with a header('Location: ../index.php'); returning to the main page of the project.

Answer 1

I see a lot of answers with Allow,Deny not Deny,Allow

The order of this matters and is causing the problem. You are telling the computer that deny is more important than allow, because it is listed last. To show you... if you say:

<Files .htaccess>
Order Allow,Deny 
Deny From All
Allow From xxx.xxx.xxx.xxx 127.0.0.1
</Files>

You are saying first Allow anyone Allowed, then Deny All... Which still Denies ALL.

If you reverse to Deny,Allow you are saying Deny All, then Allow anyone Allowed.

<Files .htaccess>
Order Deny,Allow
Deny From All
Allow From xxx.xxx.xxx.xxx 127.0.0.1
</Files>

Allow command, being more important, because it is the final command, is therefore allowing those listed after Allow From command.

xxx.xxx.xxx.xxx = Your IP

Answer 2

Do this:

<Files *>
    Order Deny,Allow 
    Allow from 192.168.100.123 127.0.0.1
    Deny from all
</Files>

The list of IP's will be specific hosts you allow, like localhost.

This also works with the directive, not just file, if you want only certain directories blocked.

Answer 3

There is an even safer method. Store your include files below the web accessible folders. So if your web files are here...

/var/www/mysite.com/

Store your include files here:

/var/includes/

Then include them with a full path...

include '/var/includes/myincludes.inc.php';

From the web, the myincludes.inc.php file is completely inaccessible.