I have a PHP script that takes some sensitive data, hashes it, and then compares it against hashes in a text file on the server. Both the text file containing hashes and the PHP script are located in the same folder.

The problem is that I want only the PHP file to be able to read that text file -- not everyone on the web. However, I tried: chmod 444 filename.txt and that of course, gave everyone 'read' permissions on it -- even people on the web. Now anyone on the web can directly call that text file over my server. I tried '440' but that restricted access for the PHP file as well.

How can I make the text file readable to the local PHP script, but restrict access to it for 'everyone' on the web?

  • Wouldn't such data be better stored in a database?
    – Wildcard
    Mar 15, 2016 at 1:01
  • It is a quick page I coded for some students in my class on a department web server. For now, I'm going with the text file.
    – learnerX
    Mar 15, 2016 at 1:04
  • In that case, what about using group permissions?
    – Wildcard
    Mar 15, 2016 at 1:23
  • That's what I was thinking as well. But didn't know where to begin. Could you be more explicit regarding how I might set group permissions?
    – learnerX
    Mar 15, 2016 at 1:27
  • 1
    I think this depends on the webserver. Maybe you can use a .htaccess-file. Sometimes PHP is executed by another user as the webserver which reads the files. In this case, you could use group permissions. But then you have to know which groups are used.
    – JojOatXGME
    Mar 15, 2016 at 1:32

1 Answer 1


A common solution is to use a .htaccess file that allows access only for the local host. Try this:

Order Allow,Deny
Allow from

And save that file in the directory. You can then try to access that direction from a web browser to verify if this solution worked.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .