3

I have a PHP file that stores some connection info for part of my website. It is not "readable" from the Web, which is good. I.e. it is blank when you navigate to it from the Web.

However, even if it is blank, I would rather the server return an 403 error message when people navigate to it. Can I use .htaccess to make the server return this error? What is the proper way to do this?

5
  • 1
    What version of Apache are you using?
    – MrWhite
    Dec 23, 2016 at 10:15
  • 1
    Apache Version 2.2.23
    – posfan12
    Dec 23, 2016 at 13:15
  • 2
    Instead of showing the "403: forbidden" message, I would suggest to show a 404 so that if someone is prodding your server then they won't even be privy to knowing about the existence of the "cryptic" sounding db_conn.php file.
    – MonkeyZeus
    Dec 23, 2016 at 14:21
  • 2
    Best practice is to have these PHP files outside of the web root, which would make this a non-issue. Dec 23, 2016 at 15:53
  • @TimFountain Agreed but consider that a luxury rather than a norm especially when running on a budget webhost.
    – MonkeyZeus
    Dec 23, 2016 at 16:32

2 Answers 2

4

It is not "readable" from the Web

What you are seeing is the output after the PHP file has been processed. Since you are probably only setting some variables then there is no output, but it is still processed. If PHP should fail, or the file should get an error/corrupted then this could expose the PHP contents.

Ideally, you would simply put this file outside/above the document root. That way you don't have to do anything to block it from the public and will still be blocked should anything untoward happen (such as your .htaccess being accidentally deleted!).

To block this with mod_rewrite in .htaccess:

RewriteEngine On
RewriteRule ^file-to-block\.php$ - [F]

The above should be placed near the top of your .htaccess file.

Note, however, that if you include another .htaccess file in a subdirectory, that also uses mod_rewrite, then this directive could be overridden.


However, it would be preferable to block (403) these files with mod_authz_host (Apache 2.2) or mod_authz_core (Apache 2.4). For Apache 2.2 see Simon's answer.

On Apache 2.4, using mod_authz_core:

<Files "file-to-block.php">
    Require all denied
</Files>

Alternatively, to send a 404 Not Found instead of a 403 Forbidden, then you can modify the above mod_rewrite directive:

RewriteRule ^file-to-block\.php$ - [R=404,L]
3
  • 4
    +1 for moving the file outside the document root. In particular, that avoids the common vulnerability scenario where you edit the file on the server and the editor saves a backup copy of it (e.g. file-to-block.php~), which the server no longer considers to be a PHP script, and so will allow it to be downloaded verbatim. For the same reason, if going with one of the alternative solutions, I'd prefer to make the pattern match any file with the prefix file-to-block.php, as in <Files "file-to-block.php*"> ... or RewriteRule ^file-to-block\.php - [F]. Or just block the entire directory. Dec 23, 2016 at 16:13
  • How do I move a document out of the root? Here's my path: /home/isometr1/public_html. Can I just put the file in isometr1?
    – posfan12
    Dec 25, 2016 at 1:13
  • Yes. Or even /home/isometr1/subdir.
    – MrWhite
    Dec 25, 2016 at 3:02
3

This can be easily done using Deny from all:

<Files "filetoblock.php">
    Order Allow,Deny
    Deny from all
</Files>

This will also issue a 403 status.

1
  • 1
    Note that this is for Apache 2.2 (mod_authz_host). Whilst this still works on Apache 2.4, it is considered deprecated (and has been moved to mod_authz_compat - which is a bit confusing). You don't strictly need the Deny from all directive in the above, because Deny is the default status (Order Allow,Deny), but probably best to be explicit.
    – MrWhite
    Dec 23, 2016 at 10:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.