There is a server side script written in php(say backend_file.php) or coldfusion(say backend_file.cfm).

Lets say, i am using Apache and I have a sample web folder (on my Localhost) like:

backend_file.php index.php Is it possible to restrict access of backend_file.php, when directly hit from browser?

However, index.php should be able to access backend_file.php?

Note: index.php is accessible, by direct URL access.

I mentioned index.php should be able to access backend_file.php, as it makes ajax post or get request to fetch information from backend_file.php?

3 Answers 3


If backend_file.php is going to be accessed via AJAX, then it needs to be requestable by the user. If it's only going to be accessed via require()/include(), you can use define() and defined() to prevent it from being directly loaded.

In index.php:

define('MAIN_INCLUDED', 1);

In backend_file.php:

  • 2
    This is the correct answer. There is no way to securely differentiate between direct access and AJAX access as any flags/etc are based on browser trust. Jun 15, 2014 at 1:56

If you were to rename the file to a different extension that's not a common extension for the web, you could still read it from index.php, but you can deny access from web. Apache allows this configuration and by default, only well-known web extensions (php, php5, htm, html, etc.) are allowed, because those map to well-known handlers (i.e. php will be processed by a php processor, etc.) These are defined in httpd.conf file and it is best for you to just open up that file and see which extensions are already registered. You might also want to avoid other common extensions that may not be there yet, but could come in the future.

Just rename it to something like backend_file.internalonly, and that should most likely solve the issue.

Another option is to move the file out of the public_html (or www) folder if you can. However, I prefer different extensions simply so I can keep the file in a given folder.

If this file has sensitive data (instead of just some shared code that you don't want to be hit from outside), then I would move it out of the public_html folder completely, instead of trying to get into access control related solutions (which are harder to get right, and test.)

  • Scripts are processed by the interpreting script engine (such as ASP, PHP), hence the browsers gets the HTML output of the script and not the source code.

  • However in the case where the scripting engine is not available in your machine your HTTP server will just output whatever is in your script file, which is what you want to disallow.

  • This can be done in Apache similarly to what you do to protect .htaccess files. You just add these lines to your config file


<Files ~ "^.*\.([Pp][Hh][Pp])"> #PHP protection
order allow,deny
deny from all
satisfy all

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .