Block file display by extension type in Apache

Sometimes we need to edit a PHP application file on Ubuntu and it ends up generating a .save file, example: secret-config.php.save

If someone accesses this file, they can see the original PHP content. Is there a way in Apache 2.4 to block access to files with extension .save and .swp?

Solution 1:

You could use the FilesMatch directive to deny access to these files like this:

<FilesMatch "\.(save|swp)$">
    Require all denied
</FilesMatch>

Either add this to a .htaccess file or to the corresponding <Directory> block of your vhost configuration.

Also consider to block other file types that could leak sensitive information, like e.g. .sql for mysql dumps that were inadvertantly saved within your DocumentRoot directory:

<FilesMatch "\.(save|swp|sql|sql\.gz)$">