Take the 2-minute tour ×

I have a module directory in my project and I want to prevent access to PHP files inside it. Besides I have some css and js files in that directory that should be parsed. I used this code in .htaccess

deny from all

But it made my css and js files not accessible too. How can I prevent access to just PHP files, but not css and js files?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

I've checked @xbonez code and it gives me the same error.

I'm using this code (tested):

Options -Indexes

RewriteEngine on

RewriteCond %{REQUEST_URI} !\.(css|js)$ [NC]
RewriteRule .+ - [F,L]

Remember to set Options -Indexes so that your folders are not browseable.


* this code must be put into an .htaccess file and place it inside your desired directory
* %{REQUEST_URI} = the relative url of what you have requested. Example: directory/style.css
* !\.(css|js)$ = every file that doesn't end with css or js
* .+ - [F,L] = forbid the requested url/file

share|improve this answer
Thank you @machineaddict, I solved it by removing the star. the code should be : <FilesMatch "\.(css|js)$"> –  Alireza Apr 30 '13 at 7:42

After the deny for all, you can allow access to css and js files with this directive

<FilesMatch "*\.(css|js)$">
    Order Allow,Deny
    Allow from all

Your final htaccess should look somewhat like this:

Order Deny,Allow
Deny from all

    Order Allow,Deny
    Allow from all
share|improve this answer
Thank you xbonez, I used your code, but it still doesn't parse js and css files. Now in "view srouce" mode when I click on js and css files it gives me "Server Error!" error 500 –  Alireza Apr 30 '13 at 6:47

Your Answer


