I have some subfolders in my Magento DocumentRoot like /vendor/ and /media/ this folders are not protected and are reachable from the web for everyone. Now I want to protect these folders through apache configuration. Is it possible and will it work when I deny the access for all except the IP address of my Server?

Can someone share an example of an Apache conf?

  • The media directory needs to be accessible from the web, otherwise visitors won't see an image. Or am I misunderstanding you? – Sander Mangel Sep 11 '15 at 9:11
  • Sander is right. The call to the media file will occur from the customers browser, not your server, so images will not be displayed if you block external access. – tecjam Sep 11 '15 at 9:16

To prevent access to a non-Magento related directory like /vendor, you can just deny access from everyone except your own IP addresses by adding the following to your .htaccess file:-

order deny,allow
deny from all
allow from X.X.X.X
allow from X.X.X.X
allow from X.X.X.X

As for the /media directory, you can't block it as otherwise media images in your website will not load.

If you want to prevent others from embedding your media files (and stealing your bandwidth), you can prevent hot linking by adding the following to your .htaccess file:-

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?YourDomain.com [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ - [NC,F,L]

Use .htaccess and configure and test something long these lines:

order deny,allow
deny from all
allow from

or you could use Mod_rewrite

RewriteEngine On
RewriteCond %{REMOTE_ADDR} !^192\.168\.1\.5555$
RewriteRule .* - [F]

However, as Sander pointed out in the comments above, if you block access to /media/ no product images will be displayed for anyone as the call to the media file will come from the browser, thus the current users IP, not your servers IP. So unless you call the files via a script and set the IP to that of the server you will not be able to get anything from these folders shown in the front end.

  • So is this normal that the magento media folder is reachable? Or is that a security issue? – TestBlub Sep 11 '15 at 9:37
  • This is normal as your product images are stored there. Check any Product in your store and see where the images are coming from ;) – tecjam Sep 11 '15 at 9:38
  • and my JS folder is that normal that the folder is reachable? – TestBlub Sep 11 '15 at 12:38
  • Any component that is used to assemble a web page so it can be viewed in your customer's browser must be accessible. So, JS, media, skin all will have to be readable. – Fiasco Labs Sep 15 '15 at 17:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.