I problem that anybody from web can observe my file local.xml and config.xml

I enabled Deny From all in htaccess file in folder app and direct access have been disabled for all files in this folder except for local.xml and config.xml. Unfortunately.

Can somebody advice anything?


  • 2
    Are you using apache or nginx? Commented Nov 26, 2014 at 16:19

2 Answers 2


You should have a app/.htaccess file with this in it:

Order deny,allow
Deny from all

First double check that that file is there. If it is, ask your server admin or hosting company if your server supports .htaccess files. Some hosts restrict .htaccess stuff.

Hope that helps!


i dont trust htaccess, so i use something like this in apache 2.4.x vhost config directly:

<LocationMatch ^/(app/|var/) >
    Require all denied

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.