I have written a small PHP package/site-template (should I say).

It contains a directory data/ that contains some important files that the users should not be able to see.

These file should however be accessible by my PHP scripts. Now ,the question is how can I prevent users from accessing a particular directory on the web.

Can I do this using .htaccess file? If yes, how?

If in case the user is not using Apache, but some other server like nginx or IIS or any other server for that matter. Is there a portable way to do this?

1 Answer 1


Yes, you can do this with .htaccess:

Order deny,allow
Deny from all

If you want a portable way to do this, just put the sensitive data outside of your docroot. This is the preferred way to store things like database credentials, temp files/session data, and other things you want to control access to (such as downloadable products if you're selling MP3s or ebooks online).


.htaccess is available for nginx, I believe, but it's apparently discouraged.

And, I believe, it's possible to protect the directory using file system permissions if the server is configured to run PHP using suexec. In which case, you ought to be able to set the directory to 400 to allow PHP to read the directory, but not allow direct access by users.

  • Hey Lese, thanks. But, as I said that what I have is a package that people will download and copy it to their server. I am not sure if I will be able to create a directory outside the folder where the package is copied. Nevertheless, this package might be copied to a subdirectory of the doc_root. Is there something that can be done with file permissions or something similar?
    – Ankit
    Commented Dec 24, 2011 at 22:53
  • 1
    @Ankit: A lot of apps/packages have recommended setups where you set the docroot to a child directory. It's more difficult if you want it installed in a subdirectory, but maybe a symbolic link can solve the problem. See my edit for the rest. Commented Dec 24, 2011 at 23:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.