How to correctly restrict access to some folders via htaccess

.htaccessapache-2.2

I have such directiry structure:

- www
    - folder1
        - folder2
            - folder21
            - folder22
            - folder23

I allowed all image files to be accessed

<FilesMatch \.(?i:gif|jpe?g|png)$>
    Order Deny,Allow
    Allow from all 
</FilesMatch>

I allowed all all files in certain folder to be accessed

<FilesMatch /folder2/folder22/.*>
    Order Deny,Allow
    Allow from all 
</FilesMatch>

I allowed all robots.txt files to be accessed

<FilesMatch (robots\.txt)$>
    Order Deny,Allow
    Allow from all 
</FilesMatch>

And at the end I added password restriction

AuthType Basic
AuthName "Personal use"
AuthUserFile /full/path/to/.htpasswd
Require valid-user

But when I try to access any image file via browser, I get password prompt.
Could anyone explain how to fix it and what might be the problem. Thank you.

Best Answer

Order Deny,Allow means that the deny rules are processed before the allow rules. Therefore, you will get a password prompt.

For any folders and filetypes that you want to allow access, just put the below config into your .htaccess:

<FilesMatch "\.(gif|jpe?g|png)$">
    Order Allow,Deny
    Allow from all 
    Satisfy Any
</FilesMatch>
Related Topic