2

I am just about to put a Magento site live and wondered what the best method is to protecting Magento's directories.

At the moment I have simply stuck in the following into my htaccess

RewriteRule ^(var) - [F,L]

This only protects the /var folder should I protect any others and is this the best way?

Improve this question

1 Answer 1

Reset to default
5

By default magento protects the folders that need protecting.
For example in the var folder has its own .htaccess file with this content. 

Order deny,allow
Deny from all

So does the media/customer folder.
and there may be others.
So unless you deleted something there is no need to take special precautions for protecting folders.

Improve this answer
2
  • Thanks it would seem as though someone deleted it
    – Goose84
    Commented Oct 14, 2014 at 12:59
  • I have website in subdoamin , in var folder there is .htaccess with the code as you mentioned it but still in backend it says Your web server is configured incorrectly. As a result, configuration files with sensitive information are accessible from the outside. Please contact your hosting provider. is there any extra step for subdoamins
    – inrsaurabh
    Commented May 26, 2018 at 5:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.