Deny access to all PHP files using FilesMatch, but make an exception for one file

Question

Currently, using htaccess I am denying access to any PHP file in a directory, but not the JS, PNG, CSS files in the same directory.

<FilesMatch "\.php$">
Order deny,allow
Deny from all
</FilesMatch>

What if I want to make an exception for one file ("foobar.php" for example) however? Can I write multiple statements in a single htaccess? What is the order of execution?

Answer 1

Can I write multiple statements in a single htaccess?

Yes, you can. Multiple <FilesMatch> containers in the same context (ie. .htaccess) are merged in order. So, you can block all .php files and permit a specific foobar.php file - in that order.

For example:

# Block all ".php" files
<FilesMatch "\.php$">
Order deny,allow
Deny from all
</FilesMatch>

# Permit a specific ".php" file
<FilesMatch "^foobar\.php$">
Order deny,allow
Allow from all
</FilesMatch>

Alternatively, you can use a single <FilesMatch> container and use a negative lookahead in the regex to exclude the specific file:

# OR use a negative lookahead...
<FilesMatch "^(?!foobar\.php$).+\.php$">
Order deny,allow
Deny from all
</FilesMatch>

The negative lookahead assertion (?!foobar\.php$) ensures that the regex does not match foobar.php, whilst matching all other .php files.

Note that Order, Deny, Allow are strictly Apache 2.2 directives. If you are on Apache 2.4 then you should probably change this to Require all denied and Require all granted respectively (providing you have changed over to mod_authz_core throughout your system).

Note also that the <FilesMatch> container applies to the current directory and all subdirectories.