Restrict access to subfolder / .htaccess

[aSystemOverload]

I need to restrict access to specific subfolders, these subfolders contain files that are INCLUDEd by .php files in the root.  Users must not be able to see the contents of the specific subfolders or view/run/open/download the files contained therein.

 

My hosting company suggested I put the following into .htaccess files in each folder to be restricted:

 

order allow,deny
allow from x.x.x.x
deny from all

 

This does restrict as required, but it also prevents the root controller file from including the required subfiles.  How can I restrict access to the subfolders/files for everyone except the server that runs the site?

 

Thnx

[PFMaBiSmAd]

You should be including files using a file system path, not a URL. Using a URL to include files takes at least 10x longer and uses a huge amount of server resources because each file being included causes php to make a http request back to your web server.

[aSystemOverload]

I use the following, is this recomended?

 

include_once("apps/home/initial_ix.php");

[PFMaBiSmAd]

That IS a file system path and the .htaccess file you posted won't stop it from working.

 

Is that everything you put into the .htaccess file that is inside the folder with the files being included? What exact symptom or error did you get the leads you to believe that it prevents the root controller file from including the required subfiles?

[aSystemOverload]

A php file in the root of the subfolder works ok, but css and image files in subfolders of the subfolder do not.

 

When I deleted the .htaccess, everything works.

[PFMaBiSmAd]

css and image files

 

External css files (<link rel="stylesheet" type="text/css" href="url of a css file" />) and image files (<img src="url of an image">) on a web page are directly requested by the browser and must be accessible through a URL. When you put a .htaccess file into a folder, it affects all subfolders of that folder. If you have a subfolder that you need to allow access to, you would need to put another .htaccess file into that subfolder that has an allow from all statement in it.

 

 

[aSystemOverload]

Ahhhhh, seems kinda of obvious now you say it.  Thanks!