Block access to multiple files with .htaccess - RewriteRule and FilesMatch fail

Question

I am trying to block access to specific files. Neither the RewriteRule or FilesMatch rules I have tried work on the live server, it serves the files as normal with status 200 OK (I'm expecting 404 Not Found).

The regex I am using for FilesMatch is (?:test|readme|license|changelog|-config|-sample)\.(?:php|md|txt|html?). I have tested it at https://regexr.com/ and it is successful for

• /readme.html
• /wp-content/test.txt
• /_test/test.txt

I have also tested the RewriteRule at https://htaccess.madewithlove.be/. It is successful for URL https://www.example.com/readme.html and https://www.example.com/wp-content/test.txt with .htaccess rule RewriteRule (?:test|readme|license|changelog|-config|-sample)\.(?:php|md|txt|html?) - [R=404,NC,L].

I have seen the answer at https://stackoverflow.com/a/51132806/3204075 The following does not work for me, I still get 200 OK for readme.html and test.txt in the root directory.

<filesMatch "(readme\.html|test\.txt)">
    Order Allow,Deny
    Deny from all
</filesMatch>

Can anyone suggest why the following FilesMatch and RewriteRules appear to be ignored by Apache?

RewriteRule

RewriteRule (?:test|readme|license|changelog|-config|-sample)\.(?:php|md|txt|html?) - [R=404,NC,L]

FilesMatch

<FilesMatch (?:test|readme|license|changelog|-config|-sample)\.(?:php|md|txt|html?)>
  # since apache 2.4: Require all denied
  Order Allow,Deny
  Deny from all
</FilesMatch>

Environment

• Cloudways
• Nginx 1.19.8-0
• Apache/2.4.25 (Debian)

Thanks,

Chris

Answer 1

The issue was my own misunderstanding of how Nginx works with Apache. The .htaccess rules appear not to work because they are never invoked as the request is handled by Nginx thus never reaches Apache.

For anyone else using Cloudways, it is not possible at this time for custom Nginx rules to be added through the user control panel, the SSH console or by the Support Agents.

Support can however remove file extensions from the Nginx config eg. .html and .txt. With requests for resources with these extensions now received by Apache, both the FilesMatch and RewriteRules noted in the original question work as expected.