2

My sendemail.php file is located in the root of my website, is there a way to protect it? Also i want to protect or hide my js folder, so noone can see my code with direct link or via the google inspect console. I have tried the following with htaccess, the files don't appear in the console but i can see them with direct link. Here is what i have in the htaccess:

#<Files ~ "\.js$">
 #   order allow,deny
  #  deny from all
#</Files>

For example on a website i inspect with firebug and i can't see the files.

enter image description here

  • 1
    That code is commented out? Not sure that I understand? If you block your js from direct access then how will your website work? Is this a website? What do you mean by "the files don't appear in the console but I can see them with direct link"? If that code is being executed (Apache) then it should be blocking direct access? – MrWhite Jan 2 '17 at 22:36
  • 1
    I assume you don't want someone to use your sendemail.php script for bad reasons. A good start would be to obfuscate the name so it is something like hdjels8d.php instead – Steve Jan 3 '17 at 0:46
  • @w3dk yes i commented this out because my website could not load the js. You are correct my website wouldn't work. I mean for example if i type website/main.js i don't want to give access. I have noticed on a website while i type a url it shows "forbidden" – csandreas1 Jan 3 '17 at 7:50
2
#<Files ~ "\.js$">
#   order allow,deny
#  deny from all
#</Files>

Yes, you will get a 403 Forbidden with the above code when trying to access any .js file, regardless of the way you access it, either from a direct link or when linked in your HTML source (unless it is pulled from your browser cache).

And that's the problem, you can't really protect client-side JavaScript files. They need to be downloaded to the client/browser in order to run. Once they are downloaded, they can be viewed.

However, sendmail.php is a different matter. This runs entirely on the server. But it depends on how it is being called whether it can be "protected". For example, if it's being called directly from an HTML form's action attribute then it can't simply be "hidden", as it will be hidden from your HTML form as well. In this case you need to make sure the script is secure, validating all inputs, spam protection, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.