I clean installed a new Magento shop and everything works fine. I only have a problem with the protection of the subfolders.

For example i can type in the URL


this url is reachable and i dont know how i can protect it.

1 Answer 1


The best would be to move your /vendor folder one level up which means it's outside the DocumentRoot.

Otherwise: Given that you use Apache, create an new file .htaccess in your vendor folder:

Order deny,allow
Deny from all

You should also do the same for your .modman folder if this one is within the document root.

  • Thanks for answer. Did you mean i should create a new htaccess in the DocumentRoot or in the vendor folder?
    – TestBlub
    Commented Sep 9, 2015 at 13:46
  • Yep, you're right. That .htaccess needs to go to the vendor folder. Updated my answer. Sorry for not being clear about that. Commented Sep 9, 2015 at 13:47
  • And another question. when i move the vendor folder one level up could it be that my shop is broken because of the links? and its not only my vendor folder. should i place a htaccess like this in every folder who is reachable?
    – TestBlub
    Commented Sep 9, 2015 at 13:49
  • Yes, that could possibly break your setup. Actually it depends on your deployment strategy. It makes sense to deploy only what is really needed to the live-system and lock all folders that don't need to be accessed by the browser (.git folder, .modman, etc.) Commented Sep 9, 2015 at 13:56
  • Thanks for the answer. I got another problem. My "JS" and my "media" folder are reachable and i put a htaccess in with your code. When i do that my shop design get broken. I think because of the shop cant get the images and javascripts. But i will protect that folders.. is there any option?
    – TestBlub
    Commented Sep 9, 2015 at 14:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.