Added security with .htaccess

My host provider has suggested adding the following to .htaccess in directories we don’t want visitors to access:. I’d like to make my client’s sites as secure as possible but am unsure in which directories this can be added. I don’t know enough about how this would affect included php files, and I would prefer not to test out the possibilities by trial and error on live sites. Has anyone used this or a similar method to lock down their site or can someone advise on the merits of using this?

If you don’t want visitors doing *anything* with a dir, why not change the permissions on it so that the user that the wev server runs as doesn’t have read or execute permissions on the dir?

Quote from: vbrilon at Nov 28, 2006, 12:24 AM

If you don’t want visitors doing *anything* with a dir, why not change the permissions on it so that the user that the wev server runs as doesn’t have read or execute permissions on the dir?

Would doing so allow a php script (in a directory not so protected) to include a file from such a directory?

Quote from: nzkiwi at Nov 28, 2006, 02:21 AM

Quote from: vbrilon at Nov 28, 2006, 12:24 AM

If you don’t want visitors doing *anything* with a dir, why not change the permissions on it so that the user that the wev server runs as doesn’t have read or execute permissions on the dir?

Would doing so allow a php script (in a directory not so protected) to include a file from such a directory?

By definition -- no. The web user can’t read anything in that directory. If you do need to include from that directory, but you don’t want the web server looking in there, then .htaccess is the way to do it.