2

There is a file in my public_html folder called error.log which is viewable by anyone if they just enter the URL in their browser, like: example.com/error.log

I'm running Apache. My question is, how can I hide or perhaps move this error.log so that it isn't visible to regular users?

ErrorDocument 401 default
ErrorDocument 403 default
ErrorDocument 404 default
ErrorDocument 500 default

<IfModule mod_rewrite.c>
RewriteEngine On

#   If you are having problems with the rewrite rules, remove the "#" from the
#   line that begins "RewriteBase" below. You will also have to change the path
#   of the rewrite to reflect the path to your XenForo installation.
#RewriteBase /xenforo

#   This line may be needed to enable WebDAV editing with PHP as a CGI.
#RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -l [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^error\.log$ - [F]
RewriteRule ^.*$ - [NC,L]
RewriteRule ^(data/|js/|styles/|install/|favicon\.ico|crossdomain\.xml|robots\.txt) - [NC,L]
RewriteRule ^.*$ index.php [NC,L]

1

I prefer to have my error log outside a publicly accessible directory. You can change the location of the error log either in your virtual host configuration or via a htaccess file:

php_value error_log  /home/path/error.log

Alternatively if you don't want to change its location you can prevent access like this

<Files error.log>
Order allow,deny
Deny from all
Satisfy All
</Files>

I prefer this over using mod_rewrite as that's not a terribly efficient way and this method won't break if you change the order of your rules.

| improve this answer | |
0

Yes, this file should not be publically accessible over HTTP. Presumably this is generated by your webhost and not by your own scripts? In which case your host should really have implemented the necessary restriction to block access, however, you can do this yourself in .htaccess:

RewriteRule ^error\.log$ - [F]

This should be placed above any existing mod_rewrite directives, following the RewriteEngine On directive.

This will serve a 403 Forbidden if you attempt to access this file over HTTP. You will need to download it over FTP.

| improve this answer | |
  • I have a dedicated server so, it's most likely an issue by me. I'm using XenForo software, perhaps that changes the question? I tried adding the rules you gave me, but that caused the rest of my website to stop working. I have added my .htaccess to the question in case you want to take a look – Elite_Dragon1337 Jul 4 '15 at 12:48
  • You added the rule in the wrong place, which would break your other rules! The RewriteRule directive in my answer should be above your current rules, after the RewriteEngine directive. RewriteCond directives apply to the single RewriteRule that follows. By inserting the directive where you did would result in the following directive running unconditionally. Yes, if you have control of your server and software then you shouldn't be writing the error log to a publically accessible location. It should be above the document root. – MrWhite Jul 4 '15 at 15:44
  • Is this your server error log? Or a PHP (ie. XenForo) generated error log? Each has their respective config settings for controlling the location of this file. Both can be controlled at the server level, however, XenForo might have it's own config that controls this (for PHP errors)? – MrWhite Jul 4 '15 at 15:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.