能否不依赖.htaccess或文件权限实现Web根目录内文件访问限制？

Great question—this is such a common pain point for folks building flat-file PHP tools on shared hosting! Let’s break down a fully server-agnostic approach that avoids .htaccess, skips manual permission tweaks, and lets you drop your project straight into the web root.

Core Strategy: Single Entry Point + PHP-Level Access Control #

Since you can’t modify the web root or rely on server-specific configs, we’ll use PHP itself to gate access to sensitive files and route all traffic through one central file. Here’s how to implement it step by step:

1. Organize Your Directory Structure #

Arrange your project so all sensitive code/content lives in subfolders, with only one file (index.php) at the web root. This keeps everything clean and easy to secure:

/ (Web Root)
├── index.php (唯一入口文件)
├── app/ (框架核心、后端逻辑、配置)
│   ├── bootstrap.php
│   ├── router.php
│   ├── controllers/
│   └── index.php (阻止直接访问目录)
├── content/ (平文件内容存储)
│   ├── posts/
│   ├── pages/
│   └── index.php (阻止直接访问目录)
└── public/ (允许直接访问的静态资源: CSS, JS, images)
    ├── css/
    ├── js/
    ├── img/
    └── index.php (可选，阻止目录列表)

2. Block Direct Access to Sensitive PHP Files #

Add a guard clause to every PHP file in app/ (and any other restricted folders) to ensure they’re only loaded via the entry point. This stops anyone from accessing files like app/bootstrap.php directly:

// 在app/bootstrap.php、app/controllers/Admin.php等文件开头添加
if (!defined('APP_ENTRY')) {
    http_response_code(403);
    exit('Forbidden: Direct access not allowed');
}

Then define this constant in your root index.php before loading any framework code:

// index.php 开头
define('APP_ENTRY', true);

3. Block Directory Listings #

For folders like app/ and content/, place an index.php file inside each that returns a 403 error. This prevents servers from showing a list of files if someone navigates to /app/ directly:

// app/index.php 和 content/index.php
http_response_code(403);
exit('Forbidden: Directory access not allowed');

4. Route All Traffic Through index.php #

Use index.php to handle both static resources and dynamic routes. This works across every server because it’s purely PHP-driven:

// index.php
define('APP_ENTRY', true);

// 处理静态资源请求（仅允许public/下的文件）
$requestUri = $_SERVER['REQUEST_URI'];
$publicPrefix = '/public/';
if (str_starts_with($requestUri, $publicPrefix)) {
    $filePath = __DIR__ . $requestUri;
    if (file_exists($filePath) && is_file($filePath)) {
        // 设置正确的MIME类型
        $mimeType = mime_content_type($filePath);
        header("Content-Type: $mimeType");
        // 输出文件内容
        readfile($filePath);
        exit;
    }
}

// 处理动态路由（比如客户登录、内容编辑）
require_once __DIR__ . '/app/router.php';

5. Build the Client Editing Interface #

Your admin interface (login + content editing) will be routed through index.php:

• When a user visits /admin, your router loads the AdminController
• The controller checks if the user is logged in via PHP sessions
• If not, it shows a login form; if authenticated, it loads the content editor
• All content writes use PHP’s built-in file functions (like file_put_contents()), which work on shared hosting without manual permission changes (most hosts let the web server write to folders within the web root by default)

Why This Works Everywhere #

• No .htaccess or server config changes needed: All access control and routing is handled by PHP
• No manual file permissions: Shared hosts typically grant the web server write access to its own directory
• Direct access to sensitive files/folders is blocked via PHP guards and directory index files

内容的提问来源于stack exchange，提问作者LeviJames