.htaccess to deny directory access

Question

I am trying to restrict access to directories in my root so that others cannot access the files in those dir directly in a browser. Problem I am running into is now the pages in the root for example the index.php is asking for a password and the .htaccess is in the root of the directories and not the root of the domain. This is preventing the index file from accessing include files from those directories.

What is a simple way to lock down those directories from browser access while still allowing the files in the root to access them and vistors being able to access the root pages without being asked for a password. I would like to to be as far as they know they site is viewable but, if someone starts prying around in the sub directories to steal code it will deny them but, allow the pages to access them.

I have tired this in each of the directories I have been wanting to restrict direct browser access to.

AuthType Basic
AuthName "Administrator"
AuthUserFile /home2/mesquiu0/.htpasswds./htpasswd
Require valid-user

Order Deny,Allow
Deny From All
Allow From 127.0.0.1

Answer 1

All you need to do is add the following line with an extra empty line to disable indexing the directories:

Options -Indexes

See Documentation for more info: http://httpd.apache.org/docs/current/mod/core.html#options

Answer 2

In your .htaccess file put the following line

Deny from all

And this if you like to put exceptions.

allow from all

Answer 3

Just allow the scripts that match php, aspx, etc.

apache 2.2

AuthType Basic
AuthName "Administrator"
AuthUserFile /home2/mesquiu0/.htpasswds./htpasswd
Require valid-user

#Forbid access to any files except from localhost, because of Order Deny,Allow, Allow gets applied later.
Order Deny,Allow
Deny from all
Allow from 127.0.0.1

#Allow access to files matching index.php
<Files index.php>
    Order Allow,Deny
    Allow from all
</Files>

In Apache 2.4 the rules has changed, and the correct syntax is to use Require all denied instead of Deny from all.

This is for apache 2.4

AuthType Basic
AuthName "Administrator"
AuthUserFile /home2/mesquiu0/.htpasswds./htpasswd
Require valid-user

Require host 127.0.0.1

#Allow access to files matching index.php
<Files index.php>
    Require all granted
</Files>