I've blocked .htaccess files in httpd.conf file by: Require all denied

My httpd.conf:

ServerRoot "/etc/httpd"
Listen 80
Include conf.modules.d/*.conf

User apache
Group apache

<Directory />
    AllowOverride none
    Require all denied

DocumentRoot "/var/www/html"

<Directory "/var/www">
    AllowOverride None
    # Allow open access:
    Require all granted

<Directory "/var/www/html">
    Options -Indexes +FollowSymLinks
    AllowOverride None
    Require all granted

<IfModule dir_module>
    DirectoryIndex index.html

<Files ~ "^\.?ht(access|passwd)(\.dist)?">
    Require all denied

IncludeOptional sites/*.conf

Here is my virtualhost:

<VirtualHost *:80>
        ServerName example.com

        DocumentRoot /var/www/site/

        <Location />
            AuthUserFile /etc/httpd/conf/passwd
            AuthName "ADMIN AREA"
            AuthType Basic
            require valid-user
            Order allow,deny
            Allow from
            satisfy any

        <Directory /var/www/site/>
                Options +FollowSymlinks -Multiviews
                AllowOverride all
                Require all granted


Now, when I use directive location to allow access only for certain IP addresses or using login and password, this addresses can access .htaccess file. How can I resolve this problem? The .htaccess cannot be viewed by anyone.

  • 1
    It should be "^\.?ht(access|passwd)|(\.dist)?" – Rui F Ribeiro Feb 21 '18 at 11:02

You are mixing old and new directives, which can have unintendended consequences. In particular mod_access_compat will be used to handle things like Order allow,deny, and will take precedence over mod_authz_host for the new directives. See upgrading to 2.4.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.