0

i'm trying to hide some directories on my site by returning 404 not found error codes instead of forbidden, the problem is that the files in the directory becomes not available to php.

how can i hide the directories by returning 404 error codes for them without making them unavailable to me also?

i have seen this in apple.com and facebook.com.

this is the code i'm using in .htaccess:

Options All -Indexes
RedirectMatch 404 ^/classes(/?|/.*)$
RedirectMatch 404 ^/css(/?|/.*)$

if it's not possible how can i hide them without returning 403 because wans a hacker sees 403 he will go make some coffee sit infront of his laptop and won't leave my site without some data.

EDIT: this where i'v seen it http://images.apple.com/global/styles/

i'm not saying i want to hide very important stuff....

the important stuff are outside the web root, what i'm saying is i want to hide directories like this directory for example.

/media/ in this directory there are more than 800 directories in each directory there are more than 500 mp3's, how can i send 404 for all those directories but still be able to reach them through php or javascript, is that possible? and if not is denying access to all of this folders is my only solution?

Improve this question

1 Answer 1

Reset to default
1

"i have seen this in apple.com" Where exactly have you seen that? and how did you mentioned, if the directories are actually not available?

A folder for images or style sheets must be accessible by the client, otherwise no one can see your images, nor can the browser download the included style sheets. If you have files which are to be included only on the server-side (via PHP) put those files into directories below your web-/http-folder.

And why should any "hacker" be interested in viewing direcotries on your server, which are in the public web-folder? Did you read that somewhere? Just hiding anything does not add security.

Improve this answer
4
  • there u go images.apple.com/global/styles
    – ParparDromi
    Jul 21, 2011 at 22:41
  • I think they are just returning a standard error-page for all HTTP-errors like 403 "forbidden" and 404 "not found"… At least thats what I do sometimes (in my MODx installations)
    – feeela
    Jul 21, 2011 at 23:44
  • and how can i do that to my 800 folders just using htaccess?
    – ParparDromi
    Jul 21, 2011 at 23:58
  • You can use the ErrorDocument directive within your main .htaccess or your virtual host configuration (if you have access to it). There are examples on the linked document. Just specify the same document for every common error code.
    – feeela
    Jul 22, 2011 at 8:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.