Question

this is my current “.htaccess” file (placed on my documentroot):

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

My project structure is:

app/ <---- here i have all my php code
public/ <----- css/js/images
.htaccess
index.php <---- starting point

I wish to deny direct access to my app files, like “/app/controller/controllerName.php” (i will handle all my request by using a router instead…), how can i achieve this? Without touching the public folder tree?

Answer 1

For your current .htaccess if might make sense to do this:

ErrorDocument 404 index.php?error=404

That allows server to send proper “404” header to the client, and it still gives you control over the response. When you are at it, you might want to create entries for 400, 401, 403 and 500 errors too.

As for denying access to app/ folder, just drop .htaccess in it with this in:

Deny From All