Question

I want to restrict access to a file or files using .htaccess file. Basically, no one should be able to download file(s) using direct link to the file. However, the file should be accessible from my website.

For instance, say I have a file called Presentation.ppt. I want the visitor to have access to it through my website, but if they try to download it or access it using direct link then the server should reject the request.

Is it possible to do that using .htaccess?

Thank you in advance,

Answer 1

Thank you all for your answers. I have tried all of your suggestions, but I still couldn’t get it working. However, I did come up with a solution that does work.

Step 1: Disable or turn off Option Indexes on your web server by removing the word indexes leaving everything else the same. In some instances, you may be able to do this using .htaccess file. If you are unable to do this with .htaccess, then you will have to look for httpd.conf file in your server. It is usually located at etc/apache/httpd.conf or etc/httpd/conf/httpd.conf. Once you find it, turn this option off in there.

Step 2: Create a folder within your webpage folder and call it whatever you want but make sure it is not easily guessable or that it is obvious (i.e. Joe33CompanyOCT2MeBoss). Then, move the files you want to hide or protect from your visitor into this folder.

Step 3: Within robot.txt file, disallow all bots or crawlers from indexing your folder or the files within this folder by entering, “Disallow yourfoldername.”

Step 4: Then you will have to create a PHP file using a similar code below. The code below will force download.

        $File1 = 'http://yourwebsite.com/Joe33CompanyOCT2MeBoss/Presentation.ppt';
        header("Content-Disposition: attachment; filename=\"".basename($File1)."\"");
        header("Content-Type: application/force-download");
        ob_end_clean();
        flush();
        readfile($File1);
        exit;

This way direct path to the file is hidden from your visitor and even though they can download the file directly they simply don’t know the actual URL to the file, because force download php code doesn’t reveal the actual path to the file. So, now my visitors to my website has to go through my webpage for downloading this file instead of directly.

Following stackoverflow questions have been very instrumental in helping me solve my programming issues. Thanks,

How to Automatically Start a Download in PHP?

php file force download