Running Apache on Ubuntu 18.04:
Everything is working fine for the most part, but I can't seem to figure out how to prevent people from accessing a directory without preventing the website from accessing that same directory.
For example, if my file tree is var/www/website/css and var/www/website/html, and the document root is var/www/website/html, the html files don't have any css. If I put them in the same directory, I can browse the css directory from the website, which I don't want and I assume is a security risk. Same goes for images etc. I've tried using .htaccess to prevent web access to the folders, but then I have the same issue, and the html can't access the css, images etc. Am I missing something? I've been using "deny from all" in the .htaccess file, because that's what I understood from the documentation
but do I need to put something else in there? Do I need to use php? I've never run a webserver before so I'm really just learning as I go.
Alright, so I've figured out how to do remove access to the index pages, i.e. example.com/images/ gives a 403. (Changing Directory section in conf file to Options -Indexes)
That's great, but I can still access specific file paths, with or without an .htaccess file, i.e. example.com/images/image.png. Is there any way to stop this?