防止直接访问 .htaccess 文件

Question

i need to prevent access to .htaccess file. my file is:

# secure htaccess file
<Files .htaccess>
 order allow,deny
 deny from all
</Files>

# disable directory browsing
Options All -Indexes

when i check URL :

http://localhost/cms/htaccess

I see .htaccess file data

How do i can prevent/deny access to .htaccess file?

Answer 1

You're blocking .htaccess but accessing http://localhost/cms/htaccess

Try accessing http://localhost/cms/.htaccess

If you want to block both try this FilesMatch directive with regex:

<FilesMatch "\.?htaccess$">
 order allow,deny
 deny from all
</FilesMatch>

Answer 2

You can secure access Within an htaccess file itself, the scope of the directive only applies to that directory, See the below code.

To secure the htaccess file.

<Files "log.txt">
Order Allow,Deny
Deny from all
</Files>

In your htaccess file in your local. Also you can use mod_rewrite to sort of handle both cases deny & access to htaccess file as well as log.txt:

RewriteRule /?\.htaccess$ - [F,L]

RewriteRule ^/?inscription/log\.txt$ - [F,L]