通过.htaccess限制目录/文件直接访问但允许网站内部调用

Got it, let's sort out this problem where you want to stop users from typing a directory/file URL directly into their browser, but still let your website load resources from those restricted paths. Your initial RewriteRule ^(data/) - [F,L,NC] works for blocking direct access, but it's too broad—it blocks all requests, including the ones your own site makes (like images, stylesheets, or scripts loaded from the data directory). Here's how to fix this properly:

Method 1: Apache .htaccess with Referer Check (Simplest Solution) #

The key is to only block requests that don't come from your own website. We can do this by checking the HTTP_REFERER header, which browsers send when a resource is loaded as part of a page from your domain.

Add these rules to your .htaccess file:

RewriteEngine On

# Block direct access to the data directory, but allow internal requests
RewriteCond %{HTTP_REFERER} !^https?://%{HTTP_HOST}/ [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteRule ^data/ - [F,L,NC]

Breakdown: #

• RewriteCond %{HTTP_REFERER} !^https?://%{HTTP_HOST}/ [NC]: Checks if the request's referrer is not from your domain (matches both HTTP and HTTPS, case-insensitive).
• RewriteCond %{HTTP_REFERER} !^$: Excludes requests with an empty referrer (rare, but some edge cases might trigger this).
• RewriteRule ^data/ - [F,L,NC]: If both conditions are met, return a 403 Forbidden response (F flag), stop processing further rules (L flag), and ignore case (NC).

This way, when your site loads a resource like <img src="/data/logo.png">, the browser sends a referrer pointing to your domain, so the rule skips blocking it. But if someone types https://yourdomain.com/data/logo.png directly into their browser, the referrer is empty or not your domain, so they get a 403.

Method 2: Target Specific File Extensions #

If you only need to block certain file types (e.g., images, CSS, JS) in the restricted directory, adjust the rule to match those extensions:

RewriteEngine On

# Block direct access to specific file types in data/
RewriteCond %{HTTP_REFERER} !^https?://%{HTTP_HOST}/ [NC]
RewriteRule ^data/.*\.(jpg|jpeg|png|css|js)$ - [F,L,NC]

Method 3: Code-Level Restriction (For Dynamic Files) #

If you're using server-side code like PHP, you can add a check at the top of restricted files to block direct access:

// Add this to the start of files you want to protect
if (!isset($_SERVER['HTTP_REFERER']) || strpos($_SERVER['HTTP_REFERER'], $_SERVER['HTTP_HOST']) === false) {
    header('HTTP/1.1 403 Forbidden');
    exit;
}

Note on Referer Limitations: #

The Referer header can be disabled by some browsers or extensions, which might cause legitimate internal requests to fail. For a more robust solution, use a proxy script to load resources:

Example Proxy Script (PHP)

Create a script like load-resource.php to handle resource requests:

<?php
$allowedDirectories = ['data'];
$targetFile = $_GET['file'] ?? '';

// Prevent directory traversal attacks
$realPath = realpath($targetFile);
if (!$realPath || !in_array(dirname($realPath), array_map('realpath', $allowedDirectories))) {
    header('HTTP/1.1 403 Forbidden');
    exit;
}

// Serve the file with correct MIME type
$mimeType = mime_content_type($realPath);
header("Content-Type: $mimeType");
readfile($realPath);
exit;

Then, in your website, reference resources like this:

<img src="load-resource.php?file=data/image.jpg">
<link rel="stylesheet" href="load-resource.php?file=data/styles.css">

This way, direct access to data/image.jpg is blocked (via your original .htaccess rule), but requests through the proxy script are validated and allowed.

内容的提问来源于stack exchange，提问作者K Ahir