.htaccess - Make a directory invisible

Question

I have a .htaccess file that currently looks like:

    order allow,deny
    deny from all


Options All -Indexes
IndexIgnore         


        

Answer 1

Leaking directory existence through dot-files

There are some cases where following lines of code are not enough to hide your directory:

RewriteEngine On
RewriteRule ^include(/|/.+)?$ - [R=404,L]

Those lines won't block requests like include/.php, include/.ht, include/.htaccess (instead you will receive a 403 Forbidden error which will indicate that the directory include exists). Instead one would like to forbid access to all dot-files to prevent leaking folder existence (.git, .php (just ".php" - without a file name), .htaccess, ...). (Side note: I guess there might be some issues between the .htaccess file and main Apache config file where you can forbid access to ".ht" files and allow to execute ".php" files - that's why such requests are doing their own thing without beeing simply rewritten to 404 error. Instead they are returning 403 error).

So you can bypass the above rules by sending following requests (you'll receive 403 Forbidden error):

• http://example.com/include/.php → You'll receive 403 error
• http://example.com/include/.ht → You'll receive 403 error
• http://example.com/include/.htaccess → You'll receive 403 error

You can verify that you'll get 404 Not Found error if directory doesn't exist:

• http://example.com/DOESNT-EXIST/.php → You'll receive 404 error
• http://example.com/DOESNT-EXIST/.ht → You'll receive 404 error
• http://example.com/DOESNT-EXIST/.htaccess → You'll receive 404 error

---

Possible Fix

You need to match all the dot-files. So first you disallow access to them (403 error) and then you just rewrite 403 error to 404 error.

Options -Indexes
RewriteEngine On
RewriteRule ^secret.*$ - [R=404,L]

RewriteRule ^404_error$ - [R=404,L]


    order allow,deny

    # 403 error
    deny from all

    # Rewrite 403 error to 404 error
    # Error document must be:
    # - "a string with error text" OR
    # - an absolute path which starts with "/" OR
    # - URL (you'll get a redirect)
    ErrorDocument 403 /404_error

These requests are now blocked and you'll get an 404 Not Found error:

• /secret/treasure.php (all files and directories in that folder)
• /secret
• /secret/
• /secret?42
• /secret/?23
• /secret/.php
• /secret/.htaccess

---

This is an answer from my similar question: Rewrite requests to directory with htaccess to 404 error