Apache restricting folder for script access only

Question

I have a folder called data which has .ini files that my scripts access. I've put a .htaccess in the data folder with deny all so that the folder cannot be accessed directly. This way only my scripts on the server can access it.

Is this .htaccess method good enough? i've also tested chmod the folder to 700 which seems to also do exactly the same thing, it denies public access but allows scripts to access the files.

I am wondering if I should just use both methods? or is one method better than the other?

Ideally, I assume it would be better to place the files outside the www folder but I do not have access to that.

Answer 1

The .htaccess solution will stop requests from a client from reading the files via a web browser or similar:

deny from all

The advantage of the .htaccess file is that a future developer or admin would see the file and know you had deliberately chosen to protect that code in a well recognised way. This could help avoid issues down the line. For example if the site was copied to a new server.