Как запретить доступ ко всем .php кроме index.php?

Question

[Albert Kazan]

Причем во всех вложенных директориях. Доступен быть доступен только index.php из корня.

в htaccess сейчас написано вот это

<Files *.php>
	Order Deny,Allow
	Deny from all
#	Allow from 127.0.0.1
</Files>

<FilesMatch "(?i)((\.php|\.tpl|\.html|\.exe|\.ini|\.log|(?<!robots)\.txt))">
	Order Deny,Allow
	Deny from all
</FilesMatch>

<Files ~ "(index|r)\.(ph?p)$">
	Order Allow,Deny
	Allow from all
</Files>

Comments

[Михаил]

видимо не там у вас корень находится

Answer 1

[Антон Шаманов]

<Files .*>
    Require all denied
</Files>

Comments

[Антон Шаманов]

.htaccess

# Turn on URL rewriting
RewriteEngine On

# Hides server version on Apache
# http://www.ducea.com/2006/06/15/apache-tips-tricks-hide-apache-software-version/
ServerTokens ProductOnly
ServerSignature Off

# Forces https
<IfModule mod_rewrite.c>
    #RewriteCond %{SERVER_PORT} !^443
    #RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

    # Set certificate pinning
    # https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning
    <IfModule mod_headers.c>
        #Header set Public-Key-Pins "max-age=500; includeSubDomains; pin-sha256=\"\"; report-uri=\"report-uri\"";
    </IfModule>

    # Sets HSTS (Strict-Transport-Security)
    # https://www.owasp.org/index.php/HTTP_Strict_Transport_Security
    <IfModule mod_headers.c>
        #Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS
    </IfModule>
</IfModule>

<IfModule mod_headers.c>
    # Disable displaying webpage in Iframes -> prevents Clickjacking
    # https://www.owasp.org/index.php/Clickjacking
    Header set X-Frame-Options SAMEORIGIN

    # Block requests with incorrect MIME-types
    # https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#X-Content-Type-Options
    Header set X-Content-Type-Options "nosniff"

    # Set IE-8 XSS Filter on
    # https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#X-XSS-Protection
    Header set X-XSS-Protection "1; mode=block"

    # Disable Flash cross-domain requests
    # https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#X-Permitted-Cross-Domain-Policies
    Header set X-Permitted-Cross-Domain-Policies "none"
</IfModule>

# Installation directory
RewriteBase /

# Protect hidden files from being viewed
<Files .*>
    Require all denied
</Files>

# Allow any files or directories that exist to be displayed directly
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d

# Rewrite all other URLs to index.php/URL
# godaddy hack no input file specified
RewriteRule .* index.php [PT,QSA,L]

[Антон Шаманов]

основан на https://perishablepress.com/stupid-htaccess-tricks/ , половина закоменчена т.к. он универсальный и не везде все нужно

Answer 2

[dodo512]

Если Apache 2.4

Require expr %{REQUEST_URI} !~ m#^(?!/index\.php$).*\.php#