Question

Seems it is a question about .htaccess, not sure what should I use.

How can I make files inside /data/ folder available to read and write only for scripts?

Users should not have access to them from browser window.

Answer 1

Simplest way to block access to non-scripts: move it outside the web server’s document root. If your PHP files are served from /var/www/htdocs, put your data files in /var/www/data.

If that’s not possible, the .htaccess solution looks like:

# don't let anyone access these files directly
Order allow,deny
Deny from all