How do I prohibit access to one of my folders with .htaccess?

You can only place the following directive in the .htaccess file in /var/www/html/include:

Order Allow,Deny Deny from all

This will limit web access to the files in /include. If you want to deny access only to the .php files, but keep the other files accessible:

<FilesMatch “.php$”> Order Allow,Deny Deny from all </FilesMatch>

Further, there is no need to add “Allow From {my droplet IP address}”, as the .htaccess will not limit your scripts from accessing the files in the /include directory.

The approach with .htaccess is on the right track for restricting access to a directory on an Apache server. However, there may be a few reasons why it is not working as expected:

1. Apache Configuration: Apache needs to be configured to read .htaccess files. This is done with the AllowOverride directive in the main Apache configuration file (httpd.conf or apache2.conf), which should be set to All or at least FileInfo for the directory you are trying to control.

2. IP Address: The Allow From directive with an IP address is not necessary unless you want to explicitly allow access from a specific IP, such as for development or debugging purposes. For the use case you described, you don’t need to allow any direct access to the include/ folder from the web at all; your PHP files on the server will still be able to include the files from that directory.

3. Syntax: The syntax you’re using for the <Files> block is a bit outdated. Apache 2.4 uses Require all denied instead of Order Deny,Allow and Deny from all.

Here’s how you can modify your .htaccess file in the include/ directory to prevent web access:

# Apache 2.2 syntax
<Files *>
    Order Deny,Allow
    Deny from all
</Files>

# Apache 2.4 syntax
<Files *>
    Require all denied
</Files>

You only need to use the syntax for the version of Apache that your server is running.

Here are the steps to ensure this works:

• Check Apache Version: Check which version of Apache you are running to use the correct syntax.

• Modify .htaccess: Create or modify the .htaccess file in your include/ directory with the correct syntax for your version of Apache.

• Apache Configuration: Ensure that the main Apache configuration file allows for .htaccess files to override the default settings.

• Restart Apache: After making these changes, you should restart Apache to ensure that the new configuration is active.

If you follow these steps and find that direct access to the include/ folder is still not prohibited, you may want to consult the Apache error logs for any messages that can help in troubleshooting the issue.