Whitelisting Directories with Apache

This article demonstrates how to allow access to specific directories while denying access to all other directories. We’re using Ubuntu 22.04 and Apache 2.4.58.

We’ve got two directories that we want to explicitly allow access to: “east” and “west”. All other directories (existing or not) are denied with a “403” access denied error message.

Put the following in your “.htaccess” file in the root of where the “east” and “west” directories are located.

<IfModule mod_rewrite.c>
  RewriteEngine On

  # List of directories that are permitted
  RewriteCond %{REQUEST_URI} !^/(east|west)
  # Don't forget to include the webroot
  RewriteCond %{REQUEST_URI} !^/$

  # If the above ReqriteConds match, return a 403 and stop processing.
  RewriteRule ^ - [R=403,L]
</IfModule>

Replace “east” and “west” with the directories that you want to allow. Add more by simply adding more “|” symbols to separate the list.

Note that sub-directories of “east” and “west” are also permitted.