Is it possible to configure .htaccess to block PHP requests to access items above the root folder?

say a malicious script is dropped in to a folder, and it may request access to "../../../../configure.php", I am afraid that .htaccess cannot stop the script from running, if the rules allow the offending script to run. Correct?

This is a major issue in multiple web servers running below the same public_html folder....

1 Answer 1


Yes, that does not work.

You do define access rights from the outside in the .htaccess file.

If a php script is running locally on the web server, it has access to whatever is allowed by the local permissions.

When multiple hosts are hosted on the same machine, they usually have different access rights based on users to separate the tenants from each other and thwart including files from other tenants.

There is not much you can do, except to make it impossible to drop a malicious script in the first place.

  • what if you manage multiple servers with the same user? Is there any other way to stop this? Maybe in php.ini?
    – Riccardo
    Commented Nov 23, 2017 at 17:10
  • Probably not; php.ini has global settings; to globally disallow access to .. does not seem like a good idea.
    – Tobi Nary
    Commented Nov 23, 2017 at 17:12
  • Maybe I could set permissions to readonly in the subfolders? That would block dropping in files. Of course it would recquire each allowed update to change permissions
    – Riccardo
    Commented Nov 23, 2017 at 17:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .