I want to deny direct access to all .php files except one: index.php
The only access to the other .php files should be through php include.
If possible I want all files in the same folder.
UPDATE:
A general rule would be nice, so I don't need to go through all files. The risk is that I forget a file or line.
UPDATE 2:
The index.php is in a folder www.myadress.com/myfolder/index.php
I want to deny access to all .php files in myfolder and subfolders to that folder.
Are you sure, you want to do that? Even css and js files and images and ...?
OK, first check if mod_access in installed to apache, then add the following to your .htaccess:
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
<Files /index.php>
Order Allow,Deny
Allow from all
</Files>
The first directive forbids access to any files except from localhost, because of Order Deny,Allow, Allow gets applied later, the second directive only affects index.php.
Caveat: No space after the comma in the Order line.
To allow access to files matching *.css or *.js use this directive:
<FilesMatch ".*\.(css|js)$">
Order Allow,Deny
Allow from all
</FilesMatch>
You cannot use directives for <Location> or <Directory> inside .htaccess files, though.
Your option would be to use <FilesMatch ".*\.php$"> around the first allow,deny group and then explicitely allow access to index.php.
Update for Apache 2.4:
This answer is correct for Apache 2.2. In Apache 2.4 the access control paradigm has changed, and the correct syntax is to use Require all denied.
Actually, I came here with the same question as the creator of the topic, but none of the solutions given were a complete answer to my problem. Why adding a code to ALL the files on your server when you could simply configure it once ? The closest one was Residuum's one, but still, he was excluding ALL files, when I wanted to exclude only php files that weren't named index.php.
So I came up with a .htaccess containing this :
<Files *.php>
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
</Files>
<Files index.php>
Order Allow,Deny
Allow from all
</Files>
(Remember, htaccess files are working recursively, so it suits perfectly the prerequisite of the question.)
And here we go. The only php files that will be accessible for an user will be the ones named index.php. But you can still acces to every image, css stylesheet, js script, etc.
An oblique answer to the question is to write all the code as classes, apart from the index.php files, which are then the only points of entry. PHP files that contain classes will not cause anything to happen, even if they are invoked directly through Apache.
A direct answer is to include the following in .htaccess:
<FilesMatch "\.php$">
Order Allow,Deny
Deny from all
</FilesMatch>
<FilesMatch "index[0-9]?\.php$">
Order Allow,Deny
Allow from all
</FilesMatch>
This will allow any file like index.php, index2.php etc to be accessed, but will refuse access of any kind to other .php files. It will not affect other file types.
You can try defining a constant in index.php and add something like
if (!defined("YOUR_CONSTANT")) die('No direct access');
to the beginning of the other files.
OR, you can use mod_rewrite and redirect requests to index.php, editing .htaccess like this:
RewriteEngine on
RewriteCond $1 !^(index\.php)
RewriteRule ^(.*)$ /index.php/$1 [L,R=301]
Then you should be able to analyze all incoming requests in the index.php and take according actions.
If you want to leave out all *.jpg, *.gif, *.css and *.png files, for example, then you should edit second line like this:
RewriteCond $1 !^(index\.php|*\.jpg|*\.gif|*\.css|*\.png)
URL rewriting could be used to map a URL to .php files. The following rules can identify whether a .php request was made directly or it was re-written. It forbids the request in the first case:
RewriteEngine On
RewriteCond %{THE_REQUEST} ^.+?\ [^?]+\.php[?\ ]
RewriteRule \.php$ - [F]
RewriteRule test index.php
These rules will forbid all requests that end with .php. However, URLs such as / (which fires index.php), /test (which rewrites to index.php) and /test?f=index.php (which contains index.php in querystring) are still allowed.
THE_REQUEST contains the full HTTP request line sent by the browser to the server (e.g., GET /index.php?foo=bar HTTP/1.1)
With Apache 2.4, the syntax for access control has changed. If using directives like:
Order deny,allow
Deny from all
does not work, you're likely using Apache 2.4.
You need to use Require all denied in one of these ways:
# you can do it this way (with "not match")
<FilesMatch ^((?!index\.php).)*$>
Require all denied
</FilesMatch>
# or
Require all denied
<Files index.php>
Require all granted
</Files>
Instead of passing a variable around I do this which is self-contained at the top of any page you don't want direct access to, this should still be paired with .htaccess rules but I feel safer knowing there is a fail-safe if htaccess ever gets messes up.
<?php
// Security check: Deny direct file access; must be loaded through index
if (count(get_included_files()) == 1) {
header("Location: index.php"); // Send to index
die("403"); // Must include to stop PHP from continuing
}
?>
