Block direct access to PHP files

Question

My present htaccess file contains mod_rewrite rules to perform this:

www.mysite.com/articles/jkr/harrypotter --> www.mysite.com/index.php?p=articles&author=jkr&book=harrypotter

www.mysite.com/articles/jkr --> www.mysite.com/index.php?p=articles&author=jkr

www.mysite.com/articles --> www.mysite.com/index.php?p=articles

In my root directory, I have some PHP files like: index.php, pre.php, view.php, etc.

What I want: block direct access to php files.

Eg:

www.mysite.com/index.php --> "404 - Page Not Found" or "File not exist"

www.mysite.com/view.php --> "404 - Page Not Found" or "File not exist"

I have tried a code that I found on searching. It uses "f" flag. But i did not understand it. When I used it do not show the home page also. So, I removed everything that I was testing. My htaccess file now contains three rules only(to accept page, author, book).

Please help.

sorry, I found solution: http://stackoverflow.com/questions/1055652/mod-rewrite-error-404-if-php — Vpp Man, Jan 11 '12 at 08:57

score 2 · Answer 1 · edited May 23 '17 at 12:22

2

I saw another question that was previous asked in here : mod_rewrite error 404 if .php

A change that I made to it is, added [NC] flag. Otherwise, if we put the uppercase letter in extension(say, "index.PHP") it will load.

So, SOLUTION:

RewriteCond %{THE_REQUEST} \.php[\ /?].*HTTP/ [NC]
RewriteRule ^.*$ - [R=404,L]

thank you

edited May 23 '17 at 12:22

Community

1
1

answered Jan 11 '12 at 08:59

Vpp Man

2,384
8
43
74

score 0 · Answer 2 · answered Jan 11 '12 at 08:57

0

Create a simple 404.php that throws a 404 error, then rewrite index.php to 404.php etc.

answered Jan 11 '12 at 08:57

Eugen Rieck

64,175
10
70
92

thank you. but after posting this question, on right side of this page under "Related" section, if found a similar question : http://stackoverflow.com/questions/1055652/mod-rewrite-error-404-if-php I added a flag and it works. – Vpp Man Jan 11 '12 at 09:00

score 0 · Answer 3 · answered Jan 11 '12 at 09:01

You can also do this at your script level. If you add a rule within your index.php to check whether you have been passed GET variables or just called the page without any parameters like so:

<?

    if(empty($_GET)) 
        header('Location: http://www.yoursite.com/404.php');
    else 
       //your usual script

?>

Then you have control to either redirect people to a 404 error or show something more helpful, like a landing page with an index or some form of website navigation.

thank you. but i am trying to do this using mod_rewrite. this will reduce the overhead in PHP code, once this mod_rewrite rules are setup. — Vpp Man, Jan 11 '12 at 09:04

Block direct access to PHP files

3 Answers3