Prevent direct access to .php files in .htaccess

Question

I want to prevent direct access to php files to prevent bot attack

It is completely shut down with the following htaccess code. it didn't work for me

RewriteEngine on 
RewriteCond %{THE_REQUEST} \.php[\ /?].*HTTP/ 
(.*)\.php$ /index.html [L]

How are humans gonna access those .php files if you prevent direct access? — brombeer, May 02 '19 at 06:53
You should only have access with url. /folder/folder/example.php instead the orientation /example — Z.Kirik, May 02 '19 at 07:01
You missed the `RewriteRule` syntex in the third line. ? It should be `RewriteRule (.*)\.php$ /index.html [L] ` — Amit Verma, May 02 '19 at 07:03
Sorry I didn't get that. Could you please be a bit specific? — Amit Verma, May 02 '19 at 07:10
a php file, b php file is included. Clients cannot access b.php directly. But I want a.php file to reach b.php — Z.Kirik, May 02 '19 at 07:13
Possible duplicate of [prevent direct url access to php file](https://stackoverflow.com/questions/33999475/prevent-direct-url-access-to-php-file) — Professor Abronsius, May 02 '19 at 07:34

score 1 · Answer 1 · answered May 02 '19 at 12:54

1

If you want that just the server has access to your php files you can use this:

<Filesmatch "\.(php)$">
    Require local
</FilesMatch>

answered May 02 '19 at 12:54

TheBlueOne

Never saw Required used with that keyword before, is this documented anywhere? Can’t find anything about this on https://httpd.apache.org/docs/2.4/mod/mod_authz_core.html#require (I think this might only be a partial solution, and `local` is supposed to be an environment variable here maybe? Then that would have to be set somewhere depending on where the request came from, I don’t think this is a standard/default one …?) – 04FS May 02 '19 at 14:06
you are right. I couldnt find it too. but years ago i found it somewhere and it should test if it is the local server by ip.but its working on my site – TheBlueOne May 02 '19 at 17:15
1

I found the [documentation](http://httpd.apache.org/docs/current/mod/mod_authz_host.html) – TheBlueOne May 03 '19 at 10:43

1 Answers1