Block Folder Access with .htaccess: Apache 2.4 Guide

Updated 4 November 2026 · Standard formula, shown below

This guide shows you how to block access to a folder on your Apache 2.4 web server using the .htaccess file. You’ll learn to deny all requests to a specific directory, allow only certain IP addresses, and protect sensitive files like backups or configuration files. You’ll need FTP or file manager access to your web root and the ability to create or edit hidden files.

What You’ll Need

Access to your web server’s file system (via FTP, SSH, or a hosting control panel like cPanel)
A text editor (Notepad, VS Code, or any plain text editor)
Basic understanding of folder paths on your server
Apache 2.4 with AllowOverride set to All or at least AuthConfig and Limit (check with your host if unsure)

Step-by-Step

Locate the folder you want to protect. Identify the absolute path on your server, e.g., /home/user/public_html/private. Also note the URL path, e.g., https://example.com/private.
Create or edit the .htaccess file inside that folder. If a .htaccess file already exists, back it up first. If not, create a new empty file named exactly .htaccess (with the leading dot).
Add the deny-all rule. Open the file and paste the following block:
```
# Block all access
Require all denied
```
This is the Apache 2.4 syntax. The older Order, Deny directives are deprecated and may not work as expected.
Save and upload the file. If you’re editing locally, upload the .htaccess file to the folder via FTP. If you’re using a file manager, save the changes directly.
Test the block. Visit the folder’s URL in your browser. You should see a 403 Forbidden error. If you see a directory listing or a file, the rule hasn’t taken effect.
To allow specific IPs, modify the rule. Replace the deny-all block with:
```
Require ip 192.168.1.100
Require ip 203.0.113.5
```
This allows only those IP addresses. Everything else gets a 403.
To allow a range of IPs, use CIDR notation. For example, Require ip 192.168.1.0/24 allows all IPs from 192.168.1.1 to 192.168.1.254.
To block a specific IP while allowing everyone else, use:
```
Require all granted
Require not ip 203.0.113.7
```
Note the order: Require all granted first, then the denial.
To protect a single file inside a folder, place the .htaccess in that folder and target the file:
```
<Files "config.php">
Require all denied
</Files>
```
This blocks access to config.php but leaves other files accessible.
If you want to redirect blocked users instead of showing a 403, add:
```
ErrorDocument 403 /error-page.html
```
Place this line in the same .htaccess file. Make sure the error page exists.

Common Mistakes

Using Apache 2.2 syntax. Directives like Order Deny,Allow and Deny from all are ignored in Apache 2.4 unless the compatibility module is enabled. Always use Require directives.
Editing the wrong .htaccess. The file must be in the folder you want to protect, not in the parent directory (unless you’re using <Directory> blocks, which are not allowed in .htaccess for this purpose).
Forgetting the leading dot. The file must be named .htaccess â€“ not htaccess.txt or .htaccess.txt.
Not backing up. If you overwrite an existing .htaccess that contains other rules (like URL rewrites), you may break your site. Always back up first.
Blocking your own IP. If you’re testing from an IP you accidentally block, you’ll lock yourself out. Use a safe IP range or test from a different connection.

Tips

Test with a different browser or incognito window to avoid cached pages.
Use a dedicated folder for sensitive files and place the .htaccess there, rather than trying to filter individual files.
Combine with password protection if you need to allow some users but not others. Use AuthType Basic and Require valid-user in addition to IP restrictions.
Check your server’s error log if the rule doesn’t work; it may contain clues.
Keep the .htaccess file readable â€“ use comments (lines starting with #) to explain what each block does.

Troubleshooting

You still see the folder contents. The most likely cause is that AllowOverride is set to None for that directory. Contact your host to enable AllowOverride All or at least AllowOverride AuthConfig Limit. Alternatively, you can use the server’s main configuration file (httpd.conf) if you have access.

You get a 500 Internal Server Error. This usually means a syntax error in the .htaccess file. Check for typos, missing spaces, or incorrect directive names. The error log will show the exact line number.

The rule works but blocks too much. If you’re using Require all denied and then trying to allow an IP, make sure the IP directive comes after the denial. In Apache 2.4, the last matching Require wins, so the order matters.

You’re using a CMS like WordPress. Some plugins or themes may generate their own .htaccess rules. If your block isn’t working, check if there’s a conflicting rule in a parent directory. You may need to place your rule in the root .htaccess instead of the subfolder.

The block works locally but not on the live server. Your local Apache version may differ. Check the Apache version on the server (e.g., via phpinfo or your hosting control panel) and adjust the syntax accordingly.

Frequently Asked Questions

Can I use .htaccess to block access to a folder without affecting the rest of the site?

Yes, that’s exactly what this guide does. The .htaccess file only affects the directory it’s placed in and its subdirectories.

What’s the difference between `Require all denied` and `Deny from all`?

Require all denied is the Apache 2.4 syntax. Deny from all is from Apache 2.2 and is deprecated in 2.4, though it may still work if the compatibility module is enabled. Use the 2.4 syntax for reliability.

How do I allow access from a dynamic IP address?

You can’t use a single IP rule for a dynamic IP. Instead, you could allow a range (e.g., Require ip 192.168.0.0/16) or use a different method like HTTP authentication.

Will this block search engines from indexing the folder?

Yes, if the folder returns a 403, search engine crawlers will also get the 403 and won’t index the content. If you want to allow indexing but block humans, you’d need a different approach.

Can I block access to a folder but allow access to a specific file inside it?

Yes. Use Require all denied in the folder’s .htaccess, then add a <Files "allowed.php"> block with Require all granted to override the denial for that file.

What if my hosting provider doesn’t allow .htaccess files?

Most shared hosts do allow them. If yours doesn’t, you’ll need to use the server configuration file (httpd.conf) or a control panel option. Contact your host for assistance.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.