Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I prevent direct access to my /css and /scripts folders, and there contents? Also, is there a way I can prevent direct access to index.php? (The right way is to just go to my website, which automatically loads the home page through index.php, or go to the specific page with, which goes to index.php?page=thepage. None of my links directly go to index.php.)


share|improve this question
What exactly do you mean when you say "direct access"? And why do you want to prevent that? – innaM Oct 25 '09 at 21:19
By directly access I mean just entering in the URL and viewing it, when it's only meant to be used e.g. to style the page. – Mk12 Oct 25 '09 at 21:21
And for things like php files that send an email from a form, I don't want users directly going to that url, it would cause an error. – Mk12 Oct 25 '09 at 21:22
Just how often do you get users entering random URLs in your domain, and complaining when they get errors, or "gibberish" which is actually CSS? – grawity Oct 26 '09 at 13:53 isn't that 'random', but anyway I'm doing it a different way now. – Mk12 Oct 26 '09 at 18:10
up vote 3 down vote accepted

I'm not a web development guy, but from what I understand the following are true:

  • Loading your index.php in a browser spits out the page code that the browser receives and renders. So the browser requests:
  • The page code it gets includes certain CSS and Javascript files from your css/ and script/ directories. So the browser requests:
  • In order to include these files, the browser must request those URLs from your webserver, and your webserver must serve them from those URLs.

If so, then no, you can't do what you're asking without changing how your CSS and script files are included.

You could change the PHP, so that it's output doesn't include links to external files, but rather includes the content of those files as inline sections of the PHP output. Then you can use the webserver's standard access controls to disallow access to the css/ and script/ directories.

share|improve this answer
Ok maybe I shouldn't really bother with it it then.. – Mk12 Oct 25 '09 at 22:00

You can turn off directory browsing and then people will not be able to see the contents of folders which do not have a default document defined. Is this what you're looking for?

share|improve this answer
Well thats already impossible since won't list the directory, it will try to do index.php?page=css (and then redirect to error page). But will display it in plain text. – Mk12 Oct 25 '09 at 20:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .