How can I limit .htaccess to current directory scope only?

Use mod_rewrite to control access, instead of mod_authz_...

UPDATE: Because in .htaccess you simply don't have the fine grained control you require to limit access to a specific directory using the mod_authz_... directives. You would need access to the server config / VirtualHost. An inherent feature of .htaccess (directory context) is that it applies to the current directory and all subdirectories.

mod_rewrite is a powerful module that gives you the fine grained control you require. Since mod_rewrite is not inherited (by default), any mod_rewrite directives in subdirectories will naturally override directives in the parent - which would seem to be what you require.

Alternatively, you rethink your current directory structure and move the files that you want to protect into their own subdirectory - this is then trivial to "protect". Having a mixture of files you want to deny and allow access to in the current directory, whilst allowing all subdirectories is a bit of a code smell and inherently adds an additional layer of complexity.

Any mod_rewrite directives in subdirectories (eg. /blog/.htaccess) will naturally override this. In order to access other subdirectories you just need to make sure you only target the current directory.

For example:

Options -Indexes

RewriteEngine on

# Block all requests that target files in the current directory
# except for "index.php", "api.html" and "api_fetch.js"
# All virtual URLs are still allowed and passed through to the front-controller below
RewriteCond %{REQUEST_URI} !^/(index.php|api.html|api_fetch.js)$
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^[^/]+$ - [F]

# Front-controller
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php?path=$1 [NC,L,QSA]

---

Aside: I realise this is pseudo-ish code, but...

:
<Directory /blog>
Allow from all
</Directory>
RewriteEngine off

• The Allow, Deny and Order directives are deprecated on Apache 2.4 and should be replaced with the new Require (mod_authz_...) directives. These older directives have been moved to mod_access_compat and are provided for backwards compatibility only.

• The <Director> container is not permitted in .htaccess, this can only be used in a server or virtualhost context.

• The RewriteEngine off directive at the end of the file disables the rewrite engine for the entire file. (The last instance of this directives "wins".)