Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Even though I have code to block access to hidden files in httpd.conf, the contents of a file such as .htaccess is visible in web browsers.

The same effect is present when running the server on Windows 7 and Windows XP SP3.

The following httpd.conf code does not seem to be effective:

#
# The following lines prevent .htaccess and .htpasswd files from being 
# viewed by Web clients. 
#
<Files "^\.ht*">
    Order allow,deny
    Deny from all
    Satisfy All
</Files>

Please tell me how to make files invisble to web browsers on a Windows machine that is running the Apache 2 web server.

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

Use files ~ "^.ht"

I'm sure why your configuration contains an asterisk and it may not be related but this is the common config I use for protecting the htaccess file and includes htpassword and anything else named .htEXAMPLE

Try changing your current config to make use of my code:

AccessFileName .htaccess

#
# The following lines prevent .htaccess and .htpasswd files from being 
# viewed by Web clients. 
#
<Files ~ "^\.ht">
    Order allow,deny
    Deny from all
    Satisfy all
</Files>

AllowOverride

Also ensure that you actually have AllowOverride enabled since they may be interlinked with one another, you can set this within the configuration of your sites normally found in enabled-sites.

Syntax Errors

Another Possibility is that your config contains syntax errors simply do a apachectl configtest to see if any errors are reported in your configuration - unlikely but it can happen.

Configuration File

Another cause could be that your setup is not actually using the httpd.conf and using another config file, several different Linux distros use different configuration files, for example Ubuntu does not use httpd.conf but actually uses apache2.conf. Do a apache2 -V and it should report what conf it uses, if apache2 -V reports nothing try a httpd -V for example:

root@RAX-test-update:~# apache2 -V
Server version: Apache/2.2.22 (Ubuntu)
Server built:   Feb 13 2012 01:51:50
Server's Module Magic Number: 21051146:30
Server loaded:  APR 1.4.6, APR-Util 1.3.12
Compiled using: APR 1.4.5, APR-Util 1.3.12
Architecture:   64-bit
Server MPM:     Prefork
  threaded:     no
    forked:     yes (variable process count)
Server compiled with....
 -D APACHE_MPM_DIR="server/mpm/prefork"
 -D APR_HAS_SENDFILE
 -D APR_HAS_MMAP
 -D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
 -D APR_USE_SYSVSEM_SERIALIZE
 -D APR_USE_PTHREAD_SERIALIZE
 -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
 -D APR_HAS_OTHER_CHILD
 -D AP_HAVE_RELIABLE_PIPED_LOGS
 -D DYNAMIC_MODULE_LIMIT=128
 -D HTTPD_ROOT="/etc/apache2"
 -D SUEXEC_BIN="/usr/lib/apache2/suexec"
 -D DEFAULT_PIDLOG="/var/run/apache2.pid"
 -D DEFAULT_SCOREBOARD="logs/apache_runtime_status"
 -D DEFAULT_LOCKFILE="/var/run/apache2/accept.lock"
 -D DEFAULT_ERRORLOG="logs/error_log"
 -D AP_TYPES_CONFIG_FILE="mime.types"
 -D SERVER_CONFIG_FILE="apache2.conf"
share|improve this answer
    
Thanks for your tips. I will have to spend some time working through them. The asterisk signifies any extra characters I think, since it is the standard code as supplied by Apache. –  Andy Jun 17 '13 at 15:07
    
thanks a bunch, your code solved my problem. –  Andy Jun 17 '13 at 15:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.