Block php file access (modsecurity)

apache-2.2mod-security

How can I block all access to a PHP file? File name is similar to sm6######.php where #### can be any random digit.

How can I do it using mod_sec?

Best Answer

This sounds like a suitable situation for the <FilesMatch > directive, no need for mod_security at all.

<FilesMatch sm6[0-9]+\.php>
  Order Allow,Deny
  Deny from all
</FilesMatch>

Of course, if you don't want anyone to access the file, why not delete it or move it out of the DocumentRoot ?

If you edit your question to include more about who shouldn't be able to access the file I'll update my answer to match.

Related Topic