Prohibit browsing. htaccess files

Many hackers will attack and exploit. htaccess do the site jump, so protecting the. htaccess file is especially important.

In Apache's httpd.conf configuration file, the default is to disable access to. htaccess, intercepting the relevant configuration file as follows:

# The following lines prevent. htaccess and. htpasswd files from being
# viewed by WEB clients.
#
<filesmatch "^\.ht" >
Order Allow,deny
Deny from all
Satisfy All
</FilesMatch>

I pass: http://localhost/test/.htaccess, the local default access to my. htacess file appears:

Forbidden

You don't have permission to access/test/.htaccess on this server.

Of course, when Apache does not have such a configuration or you do not have permission to change the configuration file, you can also manually change your local. htacess file, adding the following code:

<files .htaccess>
Order Allow,deny
Deny from all
</Files>

This effect is the same as above.

When you change the deny to allow, the code is changed to the following:

<files .htaccess>
Order Allow,deny
Allow from all
</Files>

Our. htacess files can be accessed, which is, of course, dangerous, and we're just doing a test locally. Let's change it to deny.

Prohibit browsing. htaccess files