Allowing a custom folder for PHP code

ebbomuc · 2026-07-24T09:20:32+00:00

Ich habe in meiner Joomal Installation 5.4.7 im image Ordner einen Ordner angelegt, in dem ich php scripte ablege die ich dann an entsprechender Stelle verwende. Wenn ich HTProtect installiere kann ich darauf nicht mehr zugreifen. Was habe ich zu tun um das zu ermöglichen? Danke!

ebbomuc

I created a folder inside the image folder in my Joomla 5.4.7 installation where I store PHP scripts that I use in specific places.
When I install HTProtect, I can no longer access them. What do I need to do to make this possible?
Thanks!

Pascal

The field "Completely allow folder, including PHP execution" is perfect for this in the advanced shield settings - there you can, for example,
images/phpscripte
enter it.

ebbomuc

Thanks a lot - I unfortunately missed that field

ebbomuc

Sorry, but I have one more question where I'm stuck. In the "image" folder, there's also a folder that I protected with htaccess/htpasswd, and it contains PHP files.
I do get the login prompt. But after entering the credentials, I get "You don't have permission to access this resource."
Could I please ask for help to solve this problem? Thanks!

ebbomuc

Unfortunately, there's now the issue that the folder "images/scripts/helpordner" (without its own htaccess/htpasswd file inside) is being reported as Forbidden again, even though I added it to "Allow folders completely, including PHP execution (one per line)".

Pascal

What exactly are you trying to open in the browser?

The directory?
If there’s no index.php or index.htm(l) in there, that "You don't have permission to access this resource." message is normal and usually comes from directory listing being disabled by default.

ebbomuc

I open a page and index.php is there. I'm also pretty sure it was working earlier. Then I specified another folder and the problem showed up again. I uninstalled HTProtect – everything worked as usual. Then I reinstalled it and only specified the folder as before, but now I always get a 403.

Pascal

You could remove
Upload folder hardening -> Folders to harden
images
from the advanced shield settings.

And delete the /images/.htaccess file.
That's probably the issue.

Because of the first step, it won't be recreated.

/images/ and the other subfolders not explicitly allowed are still protected by the main .htaccess, but basically, it's not ideal to use upload/media folders for PHP scripts.

ebbomuc

Thanks for the quick help – everything’s working now. I’m going to move the script section out of the images and then switch it over. I still need a bit more for that, but I wanted to have the extra security from HTProtect in place already...