Writing a .htaccess file to prevent website directory browsing
Finally got around to sorting out one of the 'must work out how to do ....' problems that's been niggling me for some time with our Holiday Home website.
I found out quite by accident that it was possible to browse the file listing for the sub-directories of our website by simply entering a URL ending with the directory name followed by a trailing slash.
It's pretty obvious from looking at the website HTML that all the photos on our website are stored in a subdirectory called 'images', and even though there's nothing secret or private hidden on our website, I didn't really want everyone in the world to be able to 'hack around' the insides of the website by typing http://www.giteinbrittany.com/images/
Before I did anything, this is the sort of results you got, a listing of all the images on the website:
The support desk of my hosting provider (123-reg.co.uk) told me that I needed to write a .htaccess file but precisely what it should contain they couldn't help me with.
I tried wikipedia for help on what a .htaccess file was and although I found out a lot I was no closer to actually being able to write a file that did what I wanted. Their examples didn't cover my problem and nor did any of the linked pages.
And there sat the problem for a couple of months until I finally got around to Googling for '.htaccess to prevent directory index' and of course I fairly quickly found the instructions I needed in the first two matching entries on DevWebPro and Free webmaster help.
I now have a shiny .htaccess file containing:
And now if you try that pesky directory listing, all you'll get is:
Much better - good old Google!
I found out quite by accident that it was possible to browse the file listing for the sub-directories of our website by simply entering a URL ending with the directory name followed by a trailing slash.
It's pretty obvious from looking at the website HTML that all the photos on our website are stored in a subdirectory called 'images', and even though there's nothing secret or private hidden on our website, I didn't really want everyone in the world to be able to 'hack around' the insides of the website by typing http://www.giteinbrittany.com/images/
Before I did anything, this is the sort of results you got, a listing of all the images on the website:
Index of /images
Name Last modified Size Description
Parent Directory 20-Jul-2006 18:44 -
AerArann.gif 20-May-2006 01:07 1k
The support desk of my hosting provider (123-reg.co.uk) told me that I needed to write a .htaccess file but precisely what it should contain they couldn't help me with.
I tried wikipedia for help on what a .htaccess file was and although I found out a lot I was no closer to actually being able to write a file that did what I wanted. Their examples didn't cover my problem and nor did any of the linked pages.
And there sat the problem for a couple of months until I finally got around to Googling for '.htaccess to prevent directory index' and of course I fairly quickly found the instructions I needed in the first two matching entries on DevWebPro and Free webmaster help.
I now have a shiny .htaccess file containing:
order allow,deny
deny from all
</Files>
IndexIgnore */*
And now if you try that pesky directory listing, all you'll get is:
Index of /images
Much better - good old Google!
Labels: Website
posted by Geoffrey at 3:46 pm Permalink
0 Comments:
Post a Comment
<< Home