Q:

Apache Hide Specific File Types from Web

I have a repository of files with .php, .sh, and .txt extensions which gets checked out to the web directory of my server (/var/www).  I need the .php files to be able to be reached by typing in a url but I want the .sh and .txt files only to be accessible internally -- meaning they can be read and run by php or a cron but never by a user typing in their url.  How can I do this on apache?  Do I need to set the permissions of the files to something or mess with the .htaccess or do something else? 

A:

The correct way of doing this is by moving the files out of your document root -- you're just a configuration failure away from data leakage, which is never a fun place to be.  Look at any modern web application framework for an example and execution.
However, to do this in Apache you just use a LocationMatch directive in the appropriate context:
<LocationMatch \.sh$>
    order deny,allow
    deny from all
</Location>

