How to Block Website Access Using .htaccess “Deny from All”

What “Deny from All” Does

Deny from All is an Apache access-control directive placed inside a .htaccess file. When Apache processes a request for a protected file or directory, it checks this rule first. If the rule is present without an exception, the server returns a 403 Forbidden error to every visitor, including you.

This syntax belongs to Apache 2.2’s access model. On Apache 2.4, the modern equivalent is Require all denied — the examples below use the classic syntax first, with the Apache 2.4 version covered in its own section.

This makes it useful for:

• Blocking public access to sensitive files (config files, backups, logs)
• Restricting an entire folder from direct browser access
• Temporarily taking a website or subdirectory offline
• Preventing direct access to files that should only be loaded internally by your application

It’s a server-level block, so it applies before WordPress, PHP, or any other application logic runs — making it more reliable than plugin-based restrictions for this specific purpose.

Basic Syntax

To block all access to a folder, create or edit the .htaccess file inside that directory and add:

Order Deny,Allow

Deny from all

Any request to that folder — or any file inside it — will now return a 403 error.

Blocking Access to a Specific File

To block a single file rather than an entire directory, wrap the rule in a <Files> block:

<Files “config.php”>

    Order Deny,Allow

    Deny from all

</Files>

This is commonly used to protect configuration files, .env files, or other sensitive assets that shouldn’t be reachable directly through a browser, even if their file path is guessed or exposed.

Blocking an Entire Website

To block access to your whole site, place the rule in the root .htaccess file:

Order Deny,Allow

Deny from all

Every request will be denied. This approach is often used during migrations, staging cleanups, or when a site needs to go temporarily dark without deleting files or changing DNS.

Allowing Specific IP Addresses While Blocking Everyone Else

A full block isn’t always practical — often you want to allow your own team while blocking the public. You can combine Deny from all with Allow from to whitelist specific IPs:

Order Deny,Allow

Deny from all

Allow from 203.0.113.10

Multiple IPs can be added on separate lines or in a single Allow from statement:

Allow from 203.0.113.10 198.51.100.22

This pattern is useful for maintenance windows, private staging environments, or restricting admin areas to office or VPN IP ranges.

Apache 2.4 Syntax Difference

The Order and Deny from all syntax belongs to Apache 2.2’s access control model. Apache 2.4 replaced it with mod_authz_core, using Require directives instead:

Require all denied

To allow specific IPs on Apache 2.4, it’s clearer to combine the rules inside a <RequireAll> block rather than stacking bare Require lines, since access logic can behave differently depending on how directives are grouped:

<RequireAll>

    Require all denied

    Require ip 203.0.113.10

</RequireAll>

Using the wrong syntax for your Apache version won’t necessarily cause an error (Apache 2.4 often keeps backward compatibility active), but mixing both syntaxes in the same block can cause unpredictable results. Rules for combining multiple Require conditions can vary by server configuration, so it’s worth checking your hosting provider’s Apache 2.4 documentation before relying on more complex allow/deny logic.

Common Mistakes to Avoid

• Placing the rule in the wrong .htaccess file. Rules only apply to the directory they’re in and its subdirectories, not the whole site unless placed in the root.
• Forgetting cascading rules. A .htaccess file in a subfolder can override or add to rules set in a parent folder, so check for conflicting directives further down the directory tree.
• Blocking yourself out of the admin panel. If you deny access to a directory that includes login scripts or dashboards you still need, whitelist your own IP first before testing.
• Assuming it hides the file. Deny from all blocks access but doesn’t hide the file’s existence from all detection methods. For genuinely sensitive files, combine this with proper file permissions and, where possible, storing them outside the public web root entirely.

What .htaccess Access Rules Don’t Replace

.htaccess only controls HTTP requests handled by Apache. It does not replace proper file permissions or server-level security policies, so sensitive files should still be secured with correct permissions — and ideally kept outside the public web root — rather than relying on Deny from all as the only safeguard.

Final Thoughts

The Deny from All directive is a simple, effective way to lock down files, folders, or entire sites at the server level. Used correctly — with the right Apache syntax and clear IP allowlists where needed — it prevents unwanted access without touching your application code. Always test changes on a staging environment or with your own IP whitelisted first, so a small syntax mistake doesn’t turn into an unintended full site lockout.