Take the 2-minute tour ×

Its been a long time since I've needed to crack open an .htaccess file...

What is the simplest way to 40x prevent access to a specific file extension though out the entire site?

share|improve this question

3 Answers 3

up vote 9 down vote accepted
<FilesMatch "\.(htaccess|htpasswd|ini|log|sh|inc|bak)$">
Order Allow,Deny
Deny from all

Loaded with some common extensions, add more as you need.

share|improve this answer

If you really want a 404 (and not a 403), you can use mod_rewrite:

RewriteEngine on
RewriteRule \.ext$ - [R=404]
share|improve this answer
sorry - 403 is what I should use. I edited the question to say 40x. –  Stevko May 18 '10 at 19:36
Note that RFC 2616 allows a 404 response when the access to a resource is forbidden (see section 10.4.4). So your original question was valid. –  Artefacto May 18 '10 at 20:08
There is also Redirect 404, ref: Requests to .htaccess should return 404 instead of 403 and RedirectMatch 404, ref: Make .git directory web inaccessible - just clustering a bit here. –  hakre Jan 23 at 9:18
Doesn't work for me. RewriteEngine on RewriteRule \.lfpt$ - [R=404] displays the file. URL rewriting works elsewhere on the site. –  Steve Almond Jul 25 at 10:25
<FilesMatch "\.ext$">
    Deny from all

See the Apache documentation on FilesMatch and Deny

EDIT: Artefacto makes a good point, this will return 403, not 404, if that's important for your purposes

share|improve this answer

Your Answer


