2

I am trying to block access to specific files. Neither the RewriteRule or FilesMatch rules I have tried work on the live server, it serves the files as normal with status 200 OK (I'm expecting 404 Not Found).

The regex I am using for FilesMatch is (?:test|readme|license|changelog|-config|-sample)\.(?:php|md|txt|html?). I have tested it at https://regexr.com/ and it is successful for

  • /readme.html
  • /wp-content/test.txt
  • /_test/test.txt

I have also tested the RewriteRule at https://htaccess.madewithlove.be/. It is successful for URL https://www.example.com/readme.html and https://www.example.com/wp-content/test.txt with .htaccess rule RewriteRule (?:test|readme|license|changelog|-config|-sample)\.(?:php|md|txt|html?) - [R=404,NC,L].

I have seen the answer at https://stackoverflow.com/a/51132806/3204075 The following does not work for me, I still get 200 OK for readme.html and test.txt in the root directory.

<filesMatch "(readme\.html|test\.txt)">
    Order Allow,Deny
    Deny from all
</filesMatch>

Can anyone suggest why the following FilesMatch and RewriteRules appear to be ignored by Apache?

RewriteRule

RewriteRule (?:test|readme|license|changelog|-config|-sample)\.(?:php|md|txt|html?) - [R=404,NC,L]

FilesMatch

<FilesMatch (?:test|readme|license|changelog|-config|-sample)\.(?:php|md|txt|html?)>
  # since apache 2.4: Require all denied
  Order Allow,Deny
  Deny from all
</FilesMatch>

Environment

  • Cloudways
  • Nginx 1.19.8-0
  • Apache/2.4.25 (Debian)

Thanks,

Chris

3
  • 1
    Do you have other directives? Are .htaccess overrides enabled in the server config? Have you confirmed you are not seeing a cached response? How does Nginx fit into this picture? If it is being used as a front-end proxy to serve static content then it is going to do just that and bypass your Apache server altogether.
    – MrWhite
    Jun 28 '21 at 21:03
  • 1
    @MrWhite - you were correct, I overlooked how Nginx sits in front of Apache and is configured separately. I'm new to Linux, coming from 20 years of Windows servers. Jun 29 '21 at 10:08
  • 1
    Question revised as requested, I didn't realise it was acceptable to answer my own question. Jun 30 '21 at 8:43
2

The issue was my own misunderstanding of how Nginx works with Apache. The .htaccess rules appear not to work because they are never invoked as the request is handled by Nginx thus never reaches Apache.

For anyone else using Cloudways, it is not possible at this time for custom Nginx rules to be added through the user control panel, the SSH console or by the Support Agents.

Support can however remove file extensions from the Nginx config eg. .html and .txt. With requests for resources with these extensions now received by Apache, both the FilesMatch and RewriteRules noted in the original question work as expected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.