Is there a way to force apache to return 404 instead of 403?
Is there a way how I can configure the Apache web server to return a 404 (not found) error code instead of 403 (forbidden) for some specific directories which I want to disallow to be accessed?
I found some solutions suggesting the use of mod_rewrite, like e.g.
RewriteEngine On
RewriteRule ^.*$ /404 [L]
As the purpose of sending 404 instead of 403 is to obfuscate the directory structure, this solution is too revealing, because it redirects to some different location which makes it obvious that the directory originally accessed does in fact exist.
Answer
RedirectMatch as in e.g.
RedirectMatch 404 /\.
does the trick, it prohibits access to all files or directories starting with a dot, giving a "404 Not Found" error.
From the Apache manual: "The Redirect[Match] directive maps an old URL into a new one by asking the client to refetch the resource at the new location." By default, Redirect sends a 302 return code, but it can also return other status codes as shown above.