Disallow php scripts except for index.php in root directory (but not subdirectories)

user_13776287 0
Viewed 28

In my httpd-vhosts.conf, I am trying to do the following:

  1. disallow any php scripts except index.php in the root directory (but not subdirectories)
  2. disallow php scripts in root/wp-content

I have #2 working, but how can I do #1?

My current code is below. It does prevent *.php execution, but it also is including the subdirectories, which I need to have php working in. Note that root is C:\xampp\htdocs\installer_site

#installer_site

<VirtualHost *:80>
    DocumentRoot "C:\xampp\htdocs\installer_site"
    ServerName www.installer_site.loc

#disallow php scripts in root directory except for index.php (this is not working--it disallows php in the subdirectories)
        <DirectoryMatch "^C:\\xampp\\htdocs\\installer_site$">
            <FilesMatch "(?!^index\.php$)(^.*\.php$)">
                Order Deny,Allow
                Deny from All
            </FilesMatch>
        </DirectoryMatch>
    
#disallow php scripts in wp-content (this is working)
    <Directory "C:\xampp\htdocs\installer_site\wp-content">
        <FilesMatch "(?i)\.(php|php3?|phtml)$">
           Order Deny,Allow
           Deny from All
        </FilesMatch>
    </Directory>

</VirtualHost>
wordpress apache php
1 Answers

I found a solution, actually a question, that happened to fulfill my conditions. It used two .htaccess files.

One in the root:

<Files *.php>
    Order Deny,Allow
    Deny from all
</Files>
<Files index.php>
    Order Allow,Deny
    Allow from all
</Files>

One in the /wp-admin

<Files *.php>
    Order Deny,Allow
    Allow from all
</Files>

The end result is that:

  1. php doesn't work in the root
  2. except for index.php
  3. and php does work in wp-content

The issue was that php was being disallowed, not just in the root, but in subdirectories. The rule to allow php in wp-admin solved that issue.

user_137762870
Related