blocks|key|227645|text|创建site/includes/.htaccess文件并添加以下行：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|227646|Deny+from+all|code-block|syntax|javascript|227647|entityMap^0|2|N|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@$9|N|A|O|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|P|8|@]|D|@]|E|$I|J]]|$1|K|3|-4|5|6|7|Q|8|@]|D|@]|E|$]]]|L|$]]

Create <code>site/includes/.htaccess</code> file and add this line:

<pre><code>Deny from all
</code></pre>

blocks|key|11366|text|您还可以使用RedirectMatch拒绝对文件夹的访问|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|11367|将以下行添加到htaccess|11368|RedirectMatch+403+%5E/folder/?$|code-block|syntax|javascript|11369|这将为文件夹返回一个403+forbidden错误，即：http://example.com/folder/，但它不会阻止对该文件夹内的文件和文件夹的访问，如果你想阻止该文件夹内的所有内容，只需将正则模式更改为%5E/folder/.*$即可。|11370|另一个选项是mod-rewrite如果启用了url-rewrting-module，您可以在root/.htaccss中使用类似以下内容：|11371|RewriteEngine+on

RewriteRule+%5Efolder/?$+-+[F,L]|11372|这将在内部将对folder的请求映射到forbidden错误页面。|11373|entityMap^0|6|D|0|0|0|A|D|S|Q|2X|C|0|6|B|M|J|1A|D|0|0|7|6|J|9|0^^$0|@$1|2|3|4|5|6|7|W|8|@$9|X|A|Y|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|Z|8|@]|D|@]|E|$]]|$1|H|3|I|5|J|7|10|8|@]|D|@]|E|$K|L]]|$1|M|3|N|5|6|7|11|8|@$9|12|A|13|B|C]|$9|14|A|15|B|C]|$9|16|A|17|B|C]]|D|@]|E|$]]|$1|O|3|P|5|6|7|18|8|@$9|19|A|1A|B|C]|$9|1B|A|1C|B|C]|$9|1D|A|1E|B|C]]|D|@]|E|$]]|$1|Q|3|R|5|J|7|1F|8|@]|D|@]|E|$K|L]]|$1|S|3|T|5|6|7|1G|8|@$9|1H|A|1I|B|C]|$9|1J|A|1K|B|C]]|D|@]|E|$]]|$1|U|3|-4|5|6|7|1L|8|@]|D|@]|E|$]]]|V|$]]

You can also deny access to a folder using <code>RedirectMatch</code>

Add the following line to htaccess

<pre><code>RedirectMatch 403 ^/folder/?$
</code></pre>

This will return a <code>403 forbidden</code> error for the folder ie : <code>http://example.com/folder/</code> but it doest block access to files and folders inside that folder, if you want to block everything inside the folder then just change the regex pattern to <code>^/folder/.*$</code> .

Another option is <code>mod-rewrite</code>
If <code>url-rewrting-module</code> is enabled you can use something like the following in <code>root/.htaccss</code> :

<pre><code>RewriteEngine on

RewriteRule ^folder/?$ - [F,L]
</code></pre>

This will internally map a request for the <code>folder</code> to <code>forbidden</code> error page.

blocks|key|11176|text|在.htaccess文件中，您需要使用|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|11177|Deny+from++all|code-block|syntax|javascript|11178|将其放在site/includes/.htaccess中，以使其特定于includes目录|11179|如果您只想禁止目录文件列表，您可以使用|11180|Options+-Indexes+|11181|entityMap^0|1|9|0|0|4|N|Z|8|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@$9|T|A|U|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|V|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|W|8|@$9|X|A|Y|B|C]|$9|Z|A|10|B|C]]|D|@]|E|$]]|$1|M|3|N|5|6|7|11|8|@]|D|@]|E|$]]|$1|O|3|P|5|H|7|12|8|@]|D|@]|E|$I|J]]|$1|Q|3|-4|5|6|7|13|8|@]|D|@]|E|$]]]|R|$]]

In an <code>.htaccess</code> file you need to use

<pre><code>Deny from all
</code></pre>

Put this in <code>site/includes/.htaccess</code> to make it specific to the <code>includes</code> directory

If you just wish to disallow a listing of directory files you can use

<pre><code>Options -Indexes 
</code></pre>

blocks|key|11300|text|我们将目录设置为非常安全，拒绝所有文件类型的访问。下面是要插入到.htaccess文件中的代码。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|11301|Order+Allow,Deny+
Deny+from+all+|code-block|syntax|javascript|11302|因为我们现在已经设置了安全性，所以我们现在想要允许访问我们想要的文件类型。为此，请将以下代码添加到刚刚插入的安全代码下的.htaccess文件中。|11303|<FilesMatch+"\.(jpg%7Cgif%7Cpng%7Cphp)$">
Order+Deny,Allow
+++Allow+from+all
</FilesMatch>|11304|最终的.htaccess文件将如下所示|offset|length|style|CODE|11305|Order+Allow,Deny+
Deny+from+all+

<FilesMatch+"\.(jpg%7Cgif%7Cpng%7Cphp)$">
Order+Deny,Allow
+++Allow+from+all
</FilesMatch>|11306|来源：Allow+access+to+specific+file+types+in+a+protected+directory|11307|entityMap|0|LINK|mutability|MUTABLE|url|http://www.inmotionhosting.com/support/website/htaccess/access-specific-filetype^0|0|0|0|0|3|9|0|0|3|1O|0|0^^$0|@$1|2|3|4|5|6|7|12|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|13|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|14|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|15|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|16|8|@$M|17|N|18|O|P]]|9|@]|A|$]]|$1|Q|3|R|5|D|7|19|8|@]|9|@]|A|$E|F]]|$1|S|3|T|5|6|7|1A|8|@]|9|@$M|1B|N|1C|1|1D]]|A|$]]|$1|U|3|-4|5|6|7|1E|8|@]|9|@]|A|$]]]|V|$W|$5|X|Y|Z|A|$10|11]]]]

We will set the directory to be very secure, denying access for all file types. Below is the code you want to insert into the .htaccess file. 

<pre><code>Order Allow,Deny 
Deny from all 
</code></pre>

Since we have now set the security, we now want to allow access to our desired file types. To do that, add the code below to the .htaccess file under the security code you just inserted. 

<pre><code>&lt;FilesMatch "\.(jpg|gif|png|php)$"&gt;
Order Deny,Allow
 Allow from all
&lt;/FilesMatch&gt;
</code></pre>

your final <code>.htaccess</code> file will look like 

<pre><code>Order Allow,Deny 
Deny from all 

&lt;FilesMatch "\.(jpg|gif|png|php)$"&gt;
Order Deny,Allow
 Allow from all
&lt;/FilesMatch&gt;
</code></pre>

Source from <a href="http://www.inmotionhosting.com/support/website/htaccess/access-specific-filetype" rel="noreferrer">Allow access to specific file types in a protected directory</a>

blocks|key|11206|text|您可以为文件夹创建一个.htaccess文件，该文件应使用以下命令拒绝访问|type|unstyled|depth|inlineStyleRanges|entityRanges|data|11207|Deny+from++all|code-block|syntax|javascript|11208|或者您可以重定向到自定义的404页面|11209|Redirect+/includes/+404.html|11210|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|N|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|O|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

You can create a .htaccess file for the folder, wich should have denied access with

<pre><code>Deny from all
</code></pre>

or you can redirect to a custom 404 page

<pre><code>Redirect /includes/ 404.html
</code></pre>

blocks|key|11461|text|只需将.htaccess放入您要限制的文件夹中|type|unstyled|depth|inlineStyleRanges|entityRanges|data|11462|##+no+access+to+this+folder

#+Apache+2.4
<IfModule+mod_authz_core.c>
++++Require+all+denied
</IfModule>

#+Apache+2.2
<IfModule+!mod_authz_core.c>
++++Order+Allow,Deny
++++Deny+from+all
</IfModule>|code-block|syntax|javascript|11463|来源：MantisBT源。|offset|length|11464|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/mantisbt/mantisbt^0|0|0|3|8|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|T|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|U|8|@]|9|@$I|V|J|W|1|X]]|A|$]]|$1|K|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|L|$M|$5|N|O|P|A|$Q|R]]]]

Just put .htaccess into the folder you want to restrict

<pre><code>## no access to this folder

# Apache 2.4
&lt;IfModule mod_authz_core.c&gt;
 Require all denied
&lt;/IfModule&gt;

# Apache 2.2
&lt;IfModule !mod_authz_core.c&gt;
 Order Allow,Deny
 Deny from all
&lt;/IfModule&gt;
</code></pre>

Source: <a href="https://github.com/mantisbt/mantisbt" rel="noreferrer">MantisBT</a> sources.

blocks|key|11250|text|创建index.php、index.html和index.htm是不安全的。因为，任何人都可以通过猜测文件名来访问指定目录下的文件。例如：http://yoursite.com/includes/file.dat所以，推荐的方法是创建一个.htaccess文件来拒绝所有访问者;)。玩得开心!！|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|11251|entityMap|0|LINK|mutability|MUTABLE|url|http://yoursite.com/includes/file.dat^0|1X|11|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

Creating index.php, index.html, index.htm is not secure. Becuse, anyone can get access on your files within specified directory by guessing files name. E.g.: <a href="http://yoursite.com/includes/file.dat" rel="nofollow">http://yoursite.com/includes/file.dat</a>
So, recommended method is creating a .htaccess file to deny all visitors ;). Have fun !!

blocks|key|227765|text|您也可以在根.htaccess文件中放置此IndexIgnore+*，以禁用所有网站目录的文件列表，包括子目录|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|227766|entityMap^0|L|D|0^^$0|@$1|2|3|4|5|6|7|H|8|@$9|I|A|J|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|K|8|@]|D|@]|E|$]]]|G|$]]

You can also put this <code>IndexIgnore *</code> at your root .htaccess file to disable file listing of all of your website directories including sub-dir

blocks|key|11544|text|在Apache2.4上，可以在根.htaccess文件中使用Apache+<If>表达式来阻止对这个特定子目录和其中的所有内容的直接访问。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|11545|例如：|11546|<If+"%25{REQUEST_URI}+=~+m#%5E/site/includes($%7C/)#">
++++Require+all+denied
</If>|code-block|syntax|javascript|11547|entityMap^0|G|9|11|4|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@$9|P|A|Q|B|C]|$9|R|A|S|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|T|8|@]|D|@]|E|$]]|$1|H|3|I|5|J|7|U|8|@]|D|@]|E|$K|L]]|$1|M|3|-4|5|6|7|V|8|@]|D|@]|E|$]]]|N|$]]

On Apache 2.4 you can use an Apache <code>&lt;If&gt;</code> expression in the root <code>.htaccess</code> file to block direct access to this specific subdirectory and everything within it.
For example:
<pre><code>&lt;If &quot;%{REQUEST_URI} =~ m#^/site/includes($|/)#&quot;&gt;
 Require all denied
&lt;/If&gt;
</code></pre>

blocks|key|227927|text|您可以通过以下方式动态完成此操作：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|227928|mkdir($dirname);
@touch($dirname+.+"/.htaccess");
++$f+=+fopen($dirname+.+"/.htaccess",+"w");
++fwrite($f,+"deny+from+all");
fclose($f);|code-block|syntax|javascript|227929|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

You can do this dynamically that way:

<pre><code>mkdir($dirname);
@touch($dirname . "/.htaccess");
 $f = fopen($dirname . "/.htaccess", "w");
 fwrite($f, "deny from all");
fclose($f);
</code></pre>

blocks|key|228002|text|由于一些我不理解的原因，创建文件夹/.htaccess和添加Deny+from+All对我无效。我不知道为什么，这看起来很简单，但并不起作用，将RedirectMatch+403%5E/folder/.*$添加到根目录htaccess就可以了。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|228003|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

For some reasons which I did not understand, creating folder/.htaccess and adding Deny from All failed to work for me. I don't know why, it seemed simple but didn't work, adding RedirectMatch 403 ^/folder/.*$ to the root htaccess worked instead.

I'm trying to deny users from accessing the <code>site/includes</code> folder by manipulating the URL.

I don't know if I have to deny everything and manually make individual exceptions to allow, if I can just deny this one folder, or if there's a rewrite function that can be used. 

Specific example: I don't want to see the directory files by typing in <code>localhost/site/includes</code> into the URL.

Deny access to one specific folder in .htaccess

我试图通过操作URL来拒绝用户访问site/includes文件夹。我不知道是否必须否认所有内容并手动创建单独的例外以允许，如果我可以只拒绝这一个文件夹，或者是否有可以使用的重写函数。具体示例:我不想通过在URL中键入localhost/site/includes来查看目录文件。

问拒绝访问.htaccess中的某个特定文件夹
EN

回答 11

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问拒绝访问.htaccess中的某个特定文件夹EN

回答 11

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问拒绝访问.htaccess中的某个特定文件夹
EN