Stop visitors downloading files

Server Config
1

I want to stop anyone from downloading certain file types from my site. I can deny access to one file type using

<Files "*.sqlite">
  Order Allow,Deny
  Deny from All
</Files>

but how do I disallow downloading of other types as well?

2

I’m not sure this is the best solution, but one option would be to block all file downloads except specific allowed types. For example (using Apache 2.4+ syntax):

<FilesMatch ".*">
  Require all denied
</FilesMatch>

<FilesMatch "\.(html|css|js|jpg|png|gif)$">
  Require all granted
</FilesMatch>

This blocks everything by default and only allows access to .html, .css, .js, .jpg, .png, and .gif files.

1 Like
3

Why are those files on the server in the webroot if they are not meant to be downloaded?

I would advise to put those files somewhere else on the server that’s not in the webroot of the website. Or if that is not possible create a private folder, stuff al private things in there and then deny full access to that folder.

5 Likes