I have a directory with PHP files I do not want anonymous users to view or bots to index. However, I do want anonymous HTTP POST request-resposes to the PHP files to work (i.e. from other PHP forms on various websites).
Will it be this?
<Limit POST GET>
allow from all
</Limit>
<files "*.php">
deny from all
</files>
My PHP script processes posted data and then performs a POST to another web-service. Will the .htaccess block post-response communications from the protected PHP script?
You don’t need to do anything. PHP can’t be viewed from outside. At all. The only way to see PHP code is to somehow gain access to the computer on which it is held: this is because PHP is parsed and executed by the server to generate the HTML which is shown to the client. In other words, as long as someone has not hacked into your actual server computer, they can’t see your PHP.