[Toyman]

Anyone here experienced with .htaccess files?

I've got it working with an .htaccess file in each directory, but now they want to protect files in a sub folder using just the .htaccess file in the root of the web server.

I think I need to use the DIRECTORY directive along with the FILES directive, but I can't seem to get it to work.

I can provide more details if there's someone really good at this.

[flyguy79]

Apache? If so, what version?

DIRECTORY directives don't work in .htaccess files - they have to go in httpd.conf or a virtual host block. The FILES directive will work in .htaccess, but you may want to go with a LOCATION directive, which matches URLs instead of file/directory paths.

Edit: scratch that - Location doesn't work in .htaccess either, but FILES does. What are you trying to block?

[JimmyN]

I'm going to assume that "protect files" means you want to restrict folder/file access to certain IP addresses, require a user/password login to access the folder, etc.

.htaccess is a folder specific override. It applies to that folder and all sub folders equally. It was never intended to be placed in the root folder to restrict access only to a specific sub folder one or more levels below. Instead you place the .htaccess file in the folder you want to protect, as you apparently have it now.

If the .htaccess file you have in the root folder basically does what you want, but you have special needs for a particular sub folder under that, you can put another .htaccess file in that sub folder. It can override the rules in the parent/root folder, and either add or remove restrictions for that sub folder.

Putting it in httpd.conf with a directive is the best way to go, and you wouldn't need any .htaccess files in the folders. But if your site is hosted on a virtual server you won't have access to Apache's httpd.conf file, or the ability to re-start Apache to load the edited config file, so using .htaccess files is your only option.

I will gladly help you with it, just PM me. Our company has our own server which I manage, and we host several other business sites on it to help offset the cost of having our own equipment. And since I work from a home office the boss lets me moonlight, so I also take care of another six websites on the side. But I'm a *NIX/Apache guy, so if Microsoft is involved anywhere in this process I may not be much help.