Deny Access to Hidden Files with .htaccess

Is your website ready to go live? It’s always a good idea to block people from accessing files they shouldn't, like your .htaccess file for example! This code will block access to any files beginning with a dot.

The code

All you have to do is add this code into your .htaccess file and save it! Like all file changes, it can take some time before it updates everywhere, but you can speed up the process on your devices simply by clearing your browser’s cache. This code snippet will block users from accusing hidden files (Anything that begins with a dot)! If you want to restrict access to a specific file or folder, check out this article.

<FilesMatch "^\.">
Order allow,deny
Deny from all

Note: An .htaccess file located in a sub-directory overrides any duplicate rules from previous .htaccess files. For example, if you have a .htaccess file located in the root defining a 404 and 403 error page, and another .htaccess located in the “test” folder defining only a 404 error page, any files and folders in the “test” folder will use the 404 page defined in the "test" .htaccess file, and the 403 page defined in the root .htaccess file.


Unsure of how to install this code? It's pretty simple. A .htaccess file is called “.htaccess”, with nothing before the dot. Try finding this on your FTP software. Many systems don’t allow filenames starting with a dot (So downloading a htaccess file can be difficult at times), so that also restricts how we can create a .htaccess file. It is possible to get around these restrictions though, so here are the steps!

  1. Open your text-editing program and code your .htaccess file
  2. Once you are finished, save it as “htaccess.txt” (We will fix its name later)
  3. Upload “htaccess.txt” to your webserver and rename it to “.htaccess” (Remember that the dot is important!)

If you are still confused, or it's not working for you, check out the more detailed instruction in our Finding, Creating, and Editing a .htaccess file article.


Hopefully you were successful in installing this snippet, if you need help, feel free to send us a message! Check out the rest of the htaccess snippets to see what other amazing things you can do!


Article Author

Related Articles

Deny Website Access To Everyone But Yourself

Have your website online, but still working on it? Want to hide it from everyone but yourself? .htaccess allows you to do that quite easily, and all you need to do this is your IP address!

Setting the server timezone with .htaccess

Have your website all setup? Amazing! If you need to set the PHP timezone for your website (Maybe your website has a clock?) I'll show you how to do it here.

Deny Access to a Directory or File with .htaccess

Have your website all setup? Amazing! There might be a directory that you want no one to ever visit, not even yourself! Although this does not really make sense on a web server, here are the instructi...

How To Remove the www From Your Website URL

Don’t want your users to have to type “www.” before your website? This guide will show you how to remove the www, changing “” to “”. Let’s get started!


All code and content © 2024. Contact Us to learn more.