Prevent Access to Folders

[purex]

I am sure this is a really simple question for most but how do I restrict access to certain folders on my website without harming surfers or the search engines viewing my site.

For example, at the moment if someone types

www.domain.com/images

Then all my images are listed on a page entitled 'Index of /images'

If some types

www.domain.com/pages1to10

for example, then a list of 10 html pages is shown that reside in the folder 'pages1to10'

Thanks in advance for replies.

[bconley]

Directory browsing needs to be turned off. Depending on how your website is hosted, you may or may not be able to do this yourself. Ask your web host for instructions on how to do this. Once this is done, you need to have an index page set up in a folder that will have HTML pages. The index or default page will be the first page that shows if the folder is used as part of the URL - www.domain.com/folder

[Weedy Lady]

Make a file named .htaccess and load it to each folder (directory) where you want the items to "not display".

Type the following exactly the way it is here into NOTEPAD:

<Files .htaccess>
order allow,deny
deny from all
</Files>
IndexIgnore */*

Then save it as .htaccess. Do not save it as .htaccess.txt because it will not work. You may have to rename it after you load it to take the .txt off of the end.

Then when someone types into their browser: http://www.yoursite.com/images
they will get a nice blank page for that folder/directory

The search engines will find everything. People surfing will find everything. Just the contents of the folder/directory will not display in a browser.

I assume this is what you want to do.

[richard-s]

Many web servers are set to serve (ie. display) a default web page, when no other page is specified.

For example, when someone types just the domain name of my web site, without specifying a particular web page, they will receive the "index.html" web page.

The same happens for all my folders.

To stop people browsing my folders, I always place an "index.html" page in each folder. This page shows basic contact type information.

As "belt and braces" each folder also has an "index.htm" page which redirects browsers to the "index.html" web page.

Richard
___________
www.hemyockcastle.co.uk
Comfortable accommodation amongst the Blackdown Hills, Devon, UK

[Conficio]

Originally Posted by purex

For example, at the moment if someone types

www.domain.com/images

Then all my images are listed on a page entitled 'Index of /images'

If some types

www.domain.com/pages1to10

for example, then a list of 10 html pages is shown that reside in the folder 'pages1to10'

Is that really true? I'm just wondering, because a URL that does not end in a "/" slash is not a directory listing. So
www.domain.com/images/
should bring up the index of the images folder.

Otherwise the prevention of this effect depends on your web server (Apache, IIS, ...) and youar ability to configure it (access through ssh, ftp, or Plex, Webadmin, ...). I'd say you best ask this question to your hosting provider or in its forums. This will give you the most correct answer for your situation.

K<o>

[Kotiniemi]

While this won't prevent actual access like .htaccess file does, it will prevent unintentional listing of images within a directory by simply creating something else for the browser to see - hope it helps:

Hiding the contents of a homepage directory

[DrTandem1]

Most hosts allow you to set "permissions" for your folders. It's probably in the file manager section of your control panel. You should see something regarding permissions and they are a three-digit code.

You'll need to navigate to the folder in question. For you, that would be "images." You need to change the permissions to a code of 711.

After doing so, if a person tries to access your images folder directly, they will get a 403 error, forbidden. You can usually modify your error pages to be custom, if you desire.

This is also called chmod when executed in a shell script. Pronounced "chee-mod." The code is the same.

[Mar]

that I'm not always consistent in this :) - protecting images folders by adding an index.html is good. However, I think that putting up a blank page is missing a golden opportunity to add in at least your site navigation structure and a Google search box. That way, people could either search your site or the web - and you might earn some extra money from that. The really cool feature about Google site search boxes is that they allow you to specify that the search opens up a new window, effectively allowing you to retain visitors.

:)

Margaret

[purex]

Thanks for all your kind help.

I went with DrTandem1's idea. I use Fetch ftp software which comes up with a permissions box.

Read Write Search/Execute
Owner X X X
Group - - X
Everyone - - X

X=checked box

This tells me it is the UNIX equivalent of chmod711?

I have applied this to http://www.laserfume.com/images/

It seems to work. Do you agree?

This led me onto 2 more thoughts.

1. Can you customize the 'Forbidden' page ?
2. If someone mis-types a URL for my site, for example laserfume.com/indx.html is there a way of showing a default 'You have mis-typed and will be automatically directed to our home page now' page?

[DrTandem1]

Yes, Read, Write Execute.

[Conficio]

Originally Posted by purex

This led me onto 2 more thoughts.

1. Can you customize the 'Forbidden' page ?
2. If someone mis-types a URL for my site, for example laserfume.com/indx.html is there a way of showing a default 'You have mis-typed and will be automatically directed to our home page now' page?

Yes, it is called custom error pages. How to do it is highly dependent on your kind of webserver (apache or IIS) and how it is configured. You best google with "custom error pages <webserver-name>".

The pages you want to customize are for error code 403 (page forbidden) and 404 (page not found).

I'd recommend to make the 404 a copy of the home page with the additional text of an error. I find it rather distracting if websites do not show me an error but redirect me automatically to another page.

K<o>

[purex]

Are these correct in your view?

http://www.laserfume.com/images

http://www.laserfume.com/oopswrongpage.html

Things I noted. All the links (inc image sources) on the 'not found' page have to be absolute, i.e 'http://www.laserfume.com/link.html' because 'link.html' does not work if a visitor types in a wrong url including a directory. For example http://www.laserfume.com/images/page.html