The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The error means Apache is reading your .htaccess file, but the directory policy does not permit the Order directive. Order is a legacy access-control directive supplied by mod_access_compat; in per-directory configuration it requires the Limit override class. Edit the <Directory> block that matches the site directory, allow only the classes the file needs, reload Apache, and test again. On Apache 2.4, replacing the old rule with a Require-based rule is usually the better long-term fix.
What the error means
A request that ends in HTTP 500 after you add a line such as Order allow,deny is normally failing during configuration parsing, before Apache can serve the page. The error log may look like this:
Recommended Free Tools
.../.htaccess: Order not allowed hereApache has found the file and recognized the directive, but the directory configuration refuses that directive’s override class. The AllowOverride setting controls which groups of directives may be used in .htaccess. Its default is None. The legacy host-access directives Allow, Deny, and Order belong to the Limit class.
This is different from Apache ignoring a file. If both AllowOverride and AllowOverrideList are None, Apache does not process .htaccess files at all. An “Order not allowed here” message shows that Apache is processing the file and rejecting one directive under the active policy.
#1 Best Overall
Find the exact file and line first
- Reproduce the 500 error once.
- Open the Apache error log immediately. Typical locations include the virtual host’s configured error log or a distribution’s main Apache log; use the path defined by your installation rather than guessing.
- Copy the complete message, including the
.htaccesspath and line number. If several directories contain.htaccessfiles, this identifies the one Apache actually parsed. - Check the surrounding lines. A file containing
Order allow,deny,Allow from all, orDeny from allis using the legacy access-compatibility syntax.
Do not start by changing every Apache configuration block. The relevant policy is the one that applies to the directory containing the failing file.
Allow the required override class
Locate the matching <Directory> block
In the server configuration or the applicable virtual-host configuration, find the non-regular-expression <Directory> section whose path matches the document root or a parent directory of the failing .htaccess. Apache permits AllowOverride in a non-regex <Directory> section; placing it in a URL-space, <Location>, or regex directory block will not solve this particular policy check.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For a site stored at /var/www/example, the narrow legacy fix is:
Rank #2
- Used Book in Good Condition
<Directory "/var/www/example">
AllowOverride Limit
</Directory>Limit permits the old Allow, Deny, and Order directives in that directory’s .htaccess. Change the path to the actual document root; do not copy this example unchanged if the site lives elsewhere.
Preserve other classes the application already needs
AllowOverride is a class list, not a switch that should be replaced casually. If the file also contains rewrite directives, those commonly require the FileInfo class. Authentication directives such as AuthType and authorization directives such as Require use AuthConfig or other classes specified by the directive. Inspect the complete file and retain every class required by its directives.
<Directory "/var/www/example">
AllowOverride Limit FileInfo
</Directory>The example enables only the two classes represented by that file. Do not add classes merely because they appear in a template. A smaller policy reduces the number of settings that an uploaded or modified .htaccess can change.
Why AllowOverride All is usually the wrong first fix
AllowOverride All enables every directive that is valid in .htaccess context. It may make the error disappear, but it also grants more configuration authority than the application may need and can increase parsing work on requests. Apache’s core guidance is to keep the root <Directory "/"> restrictive for security and performance, then set the required classes on the actual site directory.
Use this decision rule:
- Use
Limitwhen the file genuinely needs legacyOrder,Allow, orDeny. - Add
FileInfowhen rewrite or other file-information directives are present. - Add
AuthConfigwhen the file contains authentication configuration that requires it. - Use
Allonly when you have documented why every permitted override is necessary and accept the broader scope.
Never “fix” a site-specific problem by loosening the global root block. The setting belongs on the directory that serves this application.
Validate and reload safely
- Save the edited server or virtual-host configuration.
- Run the configuration validator supplied by your installation, commonly
apachectl configtestor an equivalent command. Resolve every syntax error before reloading. - Reload or restart Apache using your operating system’s service method. Debian- and Ubuntu-based systems commonly use an
apache2service name; Red Hat-family systems commonly usehttpd. Use the command appropriate to the host and its service manager. - Request the affected URL again.
- Read the error log after the request. Confirm that the “Order not allowed here” entry is gone and investigate any new, separate directive error rather than repeatedly broadening
AllowOverride.
A reload command is not a substitute for validation. A failed reload can leave the previous configuration active, while a restart failure can take the service offline. Keep a copy of the working configuration so you can restore it if the change introduces another problem.
Modern Apache 2.4 alternative: replace legacy access rules
mod_access_compat exists to support configurations that still use the old directives, but Apache 2.4 documentation marks Allow, Deny, and Order as deprecated and recommends the authorization framework built around Require. If you control the application and can change its rules coherently, migrate the complete access rule instead of adding more legacy syntax.
Free tools Windows power users keep installed
One-click scans. No signup required.
Common one-to-one replacements
| Legacy rule | Apache 2.4-style rule | Use |
|---|---|---|
Order allow,deny |
Require all granted |
Allow every client subject to other server controls |
Order deny,allow |
Require all denied |
Block all access to the resource |
Allow from example.org |
Require host example.org |
Authorize clients resolving to the specified host |
Allow from 192.0.2.0/24 |
Require ip 192.0.2.0/24 |
Authorize an IP address or network |
The table shows typical intent, not a promise that every complex rule has a mechanical one-line conversion. The old Order directive controls evaluation precedence, so combinations of several Allow and Deny lines must be translated as a complete rule. Test the allowed and denied cases after migration.
Do not mix authorization systems casually
Apache discourages mixing mod_access_compat directives with the newer Require directives in the same authorization section. During a migration, remove or replace the complete old rule for that section, then validate behavior. Leaving half of the old rule beside a new Require can produce results that are difficult to reason about even when Apache accepts the syntax.
Best Value
- Used Book in Good Condition
Choose the fix that matches your access and Apache version
| Approach | Apache/version fit | Access needed | Security scope | Migration risk |
|---|---|---|---|---|
Enable Limit |
Legacy rules on current or older Apache | Server or virtual-host administrator | Narrow if limited to the site directory | Low; preserves existing semantics |
Enable required classes, such as Limit FileInfo |
Files combining access and rewrite directives | Server or virtual-host administrator | Only the classes actually used | Low, provided all required classes remain |
Replace with Require |
Preferred for Apache 2.4 configurations you control | Ability to edit and test the application rule | Modern authorization model | Medium; complex precedence must be retested |
AllowOverride All |
Any version that supports the directives | Server administrator | Broadest and least restrictive | Low immediate effort, higher ongoing exposure |
If you use shared hosting
Most shared-hosting accounts cannot edit the virtual-host or <Directory> policy. You can still identify the exact request and provide useful evidence to support staff.
- Copy the error-log line showing the full path and line number. If the panel hides logs, use its error-log viewer or ask support for the entry generated at the time of the 500 response.
- Tell the host that the file uses
Orderand ask whetherAllowOverride Limitcan be enabled for the document root, or whether the host supports an equivalentRequire-based rule. - If the host will not change the policy, remove the legacy directive only if you understand what protection it provided. A rule that blocked a private directory should not simply be deleted.
- Rewrite the rule with directives the host explicitly permits, or move the site to hosting with documented
.htaccesssupport and the required override classes.
Do not ask support to enable AllowOverride All without explaining which directives the application needs. The exact error line and the relevant snippet make a narrowly scoped request possible.
Troubleshooting branches after the first fix
The same error remains
- The edited
<Directory>path may not match the file’s actual directory. Compare it character for character with the path in the log. - A more specific child directory may define a different
AllowOverridevalue. - You may have reloaded a different Apache instance than the one serving the site. Confirm the service and virtual host handling the request.
- The file may contain another legacy directive in a different directory. Recheck the newest log entry and its line number.
The error changes to “RewriteRule not allowed here”
The original access-class problem is resolved, but the file also needs another override class. Review the directives in the file and add only the class required for the new directive, commonly FileInfo for rewrite rules.
The site now returns 403 instead of 500
Apache is parsing the configuration, but the access rule is denying the request. Check whether the old rule used Order deny,allow or a host/IP restriction and whether the replacement preserved its intended precedence. Test from an explicitly allowed client and an explicitly denied client, and inspect the error log for the authorization decision.
The file appears to have no effect
If there is no parse error and none of the file’s settings affect responses, verify whether the applicable directory policy disables overrides with AllowOverride None and AllowOverrideList None. That condition is different from the original parse error: Apache is ignoring the file rather than rejecting Order.
Practical checklist
- Capture the current error-log path and line.
- Identify the non-regex
<Directory>block for that path. - Permit
Limitonly when the file usesOrder,Allow, orDeny. - Preserve additional classes required by other directives.
- Keep the global
<Directory "/">restrictive. - Run a configuration test before reloading.
- Retest the URL and read the fresh log entry.
- On Apache 2.4, plan a complete migration to
Requirerather than expanding legacy access rules.
Bottom line
“Order not allowed here” is an override-policy error, not a mysterious syntax failure. The immediate fix is to grant the matching site directory the Limit class, while retaining any other classes the file needs. Avoid the broad shortcut of AllowOverride All. For Apache 2.4, replace the old access rule with a tested, coherent Require rule when you control the configuration; on shared hosting, give the provider the exact log entry and request the narrow policy change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
