Deny access to website but not to server (htaccess)

[Scorpion Ghost]

Another stupid problem. I have a folder on my website where I'm keeping some script I use for something. My server via Cron job has to access this folder all the time. But if someone goes to the URL of the folder they can see the Index page, and I would like to prevent it. I want it to throw up a 403 or a 404 or a 500 or any page, I don't care what it is.

I tried this in htaccess:

deny from all

But this also blocks my own server and breaks the Cron job. I tried a few other solutions I found here and there, but they didn't work.

One of the things I saw is you can block everyone but allow your server access via IP. But I'm on Hostgator Shared hosting, and so my IP isn't static (as far as I know).

Isn't there a nice elegant simple and permanent solution for this (preferably one that comes with a blowjob )? Block access to the folder to all people, allow my own server/cron to access it at will.

Thanks

 

[t2van]

You could try and chmod the folder / files so only the owner can access i.e the server. Anyone else trying to browse that url then should get an access denied. I think you want Chmod 700 so that allows the owner to execute on the folder / file. I think that might work for you..

 

[BlogPro]

Even if it is shared hosting, your server has an IP. It might not be dedicated to you, but the IP is static.

So if you only want server level access to the file.

Try adding this to your htaccess

order deny,allow
deny from all
allow from <your server's ip>

Theoretically, this should allow access to script only to your server and anyone else visiting will be restricted.

 

[Scorpion Ghost]

You could try and chmod the folder / files so only the owner can access i.e the server. Anyone else trying to browse that url then should get an access denied. I think you want Chmod 700 so that allows the owner to execute on the folder / file. I think that might work for you..

I'm not sure what chmod is. But if it's permissions, I just tried it. Right clicked on the folder and changed permissions. i literally made it 000, removed all, and still when I access the URL I would get the Index page.

2 minutes later...

Ohhhh... I think that works

I allowed Read, Write and Execute rights only to the User, and removed them from the Group and World. That made the permission be 700. Then I checked my URL and could still see the Index page. However, if I tried accessing the folders deeper, each would throw a 403 error.

BEAST MODE!!!

Okay now I'm gonna check if my Cron still runs and works... be back with a report in 5...

 

[Red Hat Cop]

Another stupid problem. I have a folder on my website where I'm keeping some script I use for something. My server via Cron job has to access this folder all the time. But if someone goes to the URL of the folder they can see the Index page, and I would like to prevent it. I want it to throw up a 403 or a 404 or a 500 or any page, I don't care what it is.

I tried this in htaccess:

deny from all

But this also blocks my own server and breaks the Cron job. I tried a few other solutions I found here and there, but they didn't work.

One of the things I saw is you can block everyone but allow your server access via IP. But I'm on Hostgator Shared hosting, and so my IP isn't static (as far as I know).

Isn't there a nice elegant simple and permanent solution for this (preferably one that comes with a blowjob )? Block access to the folder to all people, allow my own server/cron to access it at will.

Thanks

you will use folder mod permission to 400 or 700 that will keep accessible via cron job

 

[Scorpion Ghost]

Even if it is shared hosting, your server has an IP. It might not be dedicated to you, but the IP is static.

So if you only want server level access to the file.

Try adding this to your htaccess

order deny,allow
deny from all
allow from <your server's ip>

Theoretically, this should allow access to script only to your server and anyone else visiting will be restricted.

Oh, I didn't know. I thought Shared hosting meant that you're sharing the IP with other people of course, but also that the IP can change at any time. I didn't know the IP was static forever. Are you sure about this?

 

[DanDD]

you can do it by allowing your ip, server ip does not change even on shared
or just rename index.php to something random and chnage your script accordingly
then create a blank index.php and nobody can figure out anything if your files are unique names

 

[BlogPro]

Oh, I didn't know. I thought Shared hosting meant that you're sharing the IP with other people of course, but also that the IP can change at any time. I didn't know the IP was static forever. Are you sure about this?

Absolutely certain on this. A shared IP is just what the name says - a single dedicated server IP being shared among many patrons.

Your domain is just a human readable iteration of the IP. You point it using nameservers, which tell the browser which IP to connect to when the domain is typed in the browser.

Depending on the domain used, the server isolates and selects the account allocated to it and displays it on the web browser.

You're confusing a shared IP with a dynamic IP. The kind that comes with most home ISPs and will change/refresh from time to time.

Datacenter IPs are dependent on reliability and they need static IPs or else the system wouldn't know where to fetch the website from.

 

[Scorpion Ghost]

Absolutely certain on this. A shared IP is just what the name says - a single dedicated server IP being shared among many patrons.

Your domain is just a human readable iteration of the IP. You point it using nameservers, which tell the browser which IP to connect to when the domain is typed in the browser.

Depending on the domain used, the server isolates and selects the account allocated to it and displays it on the web browser.

You're confusing a shared IP with a dynamic IP. The kind that comes with most home ISPs and will change/refresh from time to time.

Datacenter IPs are dependent on reliability and they need static IPs or else the system wouldn't know where to fetch the website from.

Wow Boss explanation. Thank you. I'm aware of the difference between static and dynamic IP addresses. Frankly I had just assumed that with shared hosting (being cheap) they're throwing your shit around different IP addresses moving you shaking you however they want. I thought DEDICATED Hosting provides a static (dedicated yea) IP address.

What do they say when you assume? You're just a bitch

Well glad to learn this. Thank you for the lesson.

Let me just say. The Permission change didn't work at 700. My Cron was still hitting a wall. Maybe (and I'm assuming again) it's because I use CURL to call my cron. I don't understand this stuff very well, but maybe CURL uses a different route to call the information, I don't know.

I changed permissions to 711 though, and then it worked. I also gave EXECUTE permissions to Group and to World. So that worked. However now if someone visits my URL, they can dig in deeper into my files. ALTHOUGH, if they try to open and actual file it throws a blank page. So I guess they still can't access any information in there. Hm...

You know what, I'll try the solution you gave me @BlogPro. Since I don't actually have to worry that my server IP will change, then that would work too. Plus it would hide my URL (Folders and Files) completely. I'll try it out now and be back with a report in 5-10 minutes.

@BlogPro let me know if you have any other ideas, suggestions, tips. You seem to know your shit

 

[RAP]

There is a very simple solution.
Add to your .htaccess the rule to disable directory browsing :

Options All -Indexes

Then remove the index html in your folder.

Browser will return a 403 page (the exact error code).

Simple, clean.

 

[Scorpion Ghost]

@BlogPro - The Cron job worked with this, and the URL throws a 403 when visited. Here's what I put in htaccess:

order deny,allow
deny from all
allow from 000.000.000.000 (obviously, my server's IP)

Awesome, I'll use this. Exactly what I wanted. Thank you

 

[BlogPro]

Haha! You made my day man.

Keep killin' it.

 

[Scorpion Ghost]

Haha! You made my day man.

Keep killin' it.

I wasn't gonna reply but I have to.

No, sir, YOU made MY day

 

[BlogPro]

Let's both agree that we made each other's day.

 

[Scorpion Ghost]

Let's both agree that we made each other's day.

Dude! This is your 1000th post on BHW!

A little celebration is in order.