3

I have some .inc files that I want blocked from being accessible via web pages. I want to simply redirect them to another page or throw a 404 when those files are accessed.

I have tried this so far which does not restrict anything:

RewriteCond %{REQUEST_URI} .*\.(inc)
RewriteRule ^(.*)/ /logout.php [R=404,L]

How can I block access to all files with the extension ".inc"

  • 404 is the default response from Apache. As long as those files aren't actually there, they should already give a 404 response. Unless you have other rules that are already rewriting them. Can you add more from your .htaccess fille and more about your setup? – Stephen Ostermiller Oct 28 '19 at 22:11
  • The files are there I am needing to block access to those files from web users – another_stack_user999 Oct 29 '19 at 15:57
2

The usual way to "block" access to these files would be to serve a 403 Forbidden.

For example, using mod_authz_core on Apache 2.4:

<Files "*.inc">
    Require all denied
</Files>

If you specifically want to respond with a 404 instead then you can use mod_rewrite. This needs to go near the top of your config file. For example:

RewriteEngine On

RewriteRule \.inc$ - [R=404]

Both of these rules will result in the 403 or 404 error document being returned, which you can customise using the ErrorDocument directive. For example:

ErrorDocument 404 /errors/my404.html

Just a few notes on your code sample:

RewriteCond %{REQUEST_URI} .*\.(inc)
RewriteRule ^(.*)/ /logout.php [R=404,L]

This might have "worked", however, the RewriteRule pattern (ie. ^(.*)/) requires the URL to have contained a slash, which isn't the case for any files in the document root.

This also matches .inc anywhere inside the URL. The RewriteCond directive is not required here - you can do all the pattern matching in the RewriteRule directive.

There is no need for the capturing subpatterns, ie. the parentheses around (.*) and (inc). This creates "backreferences" which are not being used here.

When you specify a "redirect" code other than 3xx then the substitution string (ie. /logout.php) is ignored. No external redirect is triggered. You should just specify a single - (hyphen) in this case. Also, the L (last) flag is not required.


Aside: It's not a good idea to have files with the extension .inc if they are include/script files for your project (unless perhaps they are kept outside of your document root). As you may have realised, if requested directly, the browser will likely see them as text/plain and simply display them as-is in the browser. It is advisable to always use the correct script extension if possible. eg. foo.inc.php.

| improve this answer | |
  • 1
    Appreciate the info, and yes the reason I initially wanted to restrict was due to the browser displaying the php code due to the .inc file extension – another_stack_user999 Oct 30 '19 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.