Some site owners don't want people, especially their competitors, know what features they have on their sites.

Because some sensitive information in language or configuration files can be accessed directly from browser, eg.


Although only technical people know about Joomla can figure out these links, access them and find out (or guess) what the features the site has, however the site owners want everything to be secret.

So is there any server side solution or any Joomla extension to forbid direct access to these INI and XML files?

3 Answers 3


Put this directive inside your .htaccess file:

<FilesMatch ".(ini|xml)$">
  order allow,deny
  deny from all
  • Thank you! The result of this is a 403 forbidden error "Forbidden You don't have permission to access ... on this server."
    – Hung Tran
    Commented Apr 23, 2014 at 10:40

You can extend the .htaccess file of Joomla with a RewriteRule for there file types.

A simple one could be

RewriteRule \.xml$ index.php [L]
RewriteRule \.ini$ index.php [L]

these rules checks if the end of the request is ".xml" or ".ini" and rewrites the request to index.php. the [L] means last rule.

You should put this in the section

## Begin - Custom redirects
  • I tried this and the result was my homepage with no CSS styles loaded.
    – Hung Tran
    Commented Apr 23, 2014 at 10:38
  • Do your css files ends with xml or ini?! Commented Apr 23, 2014 at 10:41
  • They are not, Their extension is .css. I tested with a fresh Joomla installation.
    – Hung Tran
    Commented Apr 23, 2014 at 10:44

A Joomla extension would be the wrong approach since Joomla isn't involved when you directly access files on the server.

You can achieve what you want easily with .htaccess or in your server config. Something like this should do the trick:

<Files  ~ "\.xml$">
  Order allow,deny
  Deny from all

Taken from http://www.ducea.com/2006/07/21/apache-tips-tricks-deny-access-to-certain-file-types/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.