Take the 2-minute tour ×

When someone fetches a denied URL that exists, he gets:


Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.9 with Suhosin-Patch Server

When someone goes to a URL that does not exist he will get:

Not Found

The requested URL /notexisting/notthere.php was not found on this server.

This way someone can find out information about the directory structure in an area, that is actually not open to the public. Is this true?

If I were paranoid, what could I do? Just curious.

share|improve this question

3 Answers 3

up vote 0 down vote accepted

You could probably use SetEnvIf to check for something, like whether Remote_Addr is internal or not, and then use mod_rewrite to give 404's based on the environment variable.

share|improve this answer

Note this doesn't necessarily tell them that /admin/admin.php exists. If /admin were forbidden, /admin/notthere.php would also be a 403 Forbidden. So it's not explicitly giving away any information about your directory structure.

If you are paranoid, you could create a subdomain where the root is protected. That way, for an unauthorized user, any url will result in a 403 Forbidden message

share|improve this answer

You can configure the way Apache reacts to error, for example by setting an ErrorDocument for each error: http://httpd.apache.org/docs/2.0/mod/core.html#errordocument

share|improve this answer
but this would not change the http result code? an attacker could still look for it? –  user12096 Apr 26 '10 at 9:15

Your Answer


