iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Block hidden files at the web-server layer; do not rely on a leading dot or a filesystem “hidden” flag. On Apache, use mod_rewrite to reject requests for dot-prefixed files and directories while explicitly exempting /.well-known/. On IIS, configure Request Filtering hidden segments or denied extensions. Use NTFS permissions when access must differ by user rather than simply removing a path from public HTTP access.
Why hidden files need an HTTP rule
A filename beginning with a period is a filesystem naming convention, not an access-control policy. Directory listings may omit names such as .git and .svn, but a web server can still return those files when a client knows the URL and the files are reachable through normal URL mapping.
The Apache Software Foundation describes the underlying behavior plainly: “unless you take steps to change it, if the server can find its way to a file through normal URL mapping rules, it can serve it to clients.” A browser, scanner, or attacker does not need a directory listing if it can guess or obtain a path. A public rule should therefore deny direct HTTP requests to dot-prefixed path components, including dot-directories and files nested inside them.
This control prevents public retrieval; it does not encrypt, delete, or otherwise protect a file from processes that already have filesystem access. Keep application secrets out of the document root where practical, and treat web-server filtering as a required exposure barrier rather than the only security control.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Decide what you actually need to block
There are two different policies that are often described as “hiding” files:
- Public URL suppression: reject requests for sensitive paths regardless of the visitor. Apache rewrite rules and IIS Request Filtering implement this policy.
- User-specific authorization: allow the application or selected users to read a file while denying everyone else. On IIS, Microsoft recommends NTFS permissions for this requirement; the application-pool identity must retain read access to files the application is meant to serve.
Path-based and extension-based controls are also different. A dot-file rule covers names and directories beginning with a period. An extension policy covers suffixes such as .inc, whether or not the filename begins with a dot. Use both where the exposure risk includes source, backup, configuration, log, or database-dump artifacts.
Apache: deny dot-prefixed files and directories
Use an effective Apache authorization path
The rule must be loaded in the Apache configuration that actually handles the request. A desktop file-browser setting has no effect on HTTP, and a rule placed where Apache never applies it cannot protect anything. Confirm that mod_rewrite is available and that the site or directory configuration containing the rule is active for the requested host and path.
MDN’s pattern denies a path component beginning with a dot while preserving the standard /.well-known/ namespace:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} "!(^|/)\.well-known/([^./]+./?)+$" [NC]
RewriteCond %{SCRIPT_FILENAME} -d [OR]
RewriteCond %{SCRIPT_FILENAME} -f
RewriteRule "(^|/)\." - [F]
</IfModule>Adapt and review this pattern for your Apache version, URL normalization, and application routing before deploying it. The exact configuration context matters: a server-level rule and a per-directory rule can see different path representations, and an application may generate virtual routes that do not correspond to ordinary filesystem paths.
How the rule works
RewriteEngine Onenables rewrite processing.- The first condition excludes paths that match the
.well-knownexception. The[NC]flag makes that comparison case-insensitive. - The next two conditions require the mapped target to be either a directory or a file. The
[OR]flag joins those tests. - The rule matches a URL path component beginning with a period. The
[F]flag returns a forbidden response instead of serving the target.
This catches a direct request for a dot-file and a request for a resource below a dot-directory when the target maps to an existing file or directory. Test nested paths explicitly; do not assume that testing only the top-level name proves the entire rule works.
Recommended Free Tools
Keep /.well-known/ available when required
MDN identifies .well-known/ as the standard RFC 5785 path prefix for “well-known locations.” Discovery documents placed there may need to remain reachable even though other dot-prefixed paths should be denied. The exception in the pattern is intentionally narrow: it permits matching files in that namespace while the general dot-component rule remains in force elsewhere.
Check the exact URI shape used by the discovery mechanism on your site, including nested names and trailing slashes. If a legitimate discovery request is denied, inspect the normalized request URI and adjust the exception only as broadly as necessary. Do not remove the entire dot-file rule to solve a single exception.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Handle backup and source artifacts separately
Dot-prefixed names are only one class of accidental exposure. MDN also recommends a separate FilesMatch policy for editor backups, configuration files, logs, SQL dumps, and other source or backup artifacts. Keep that policy separate from the dot-file rule so reviewers can see which extensions or filename patterns are denied and so a change to one class does not silently weaken the other.
Use the same deployment discipline for this second policy: place it in an effective authorization context, confirm that it applies to the intended virtual host or directory, and test representative files. A broad extension rule can break legitimate downloads or application assets, so enumerate the files your application intentionally serves before tightening it.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Apache deployment checks
- Identify the active virtual-host and directory configuration for the site.
- Confirm that
mod_rewriteis loaded and that rewrite processing is permitted in that configuration context. - Install the dot-component rule and review its
/.well-known/exception against the paths your site actually uses. - Keep any backup, source, log, or SQL-dump policy in a separate block with a clearly defined scope.
- Reload or restart Apache using your platform’s normal, validated procedure.
- Run the direct-request checks in the validation section and inspect the access and error logs for the resulting requests.
IIS: Request Filtering for hidden paths and extensions
Block path segments with Hidden Segments
IIS Request Filtering has a hiddenSegments collection for URL segments that should not be accessible. This is the closest IIS equivalent to a path-based dot-file rule.
- Select the site or directory in IIS Manager.
- Open Request Filtering.
- Choose Hidden Segments.
- Add each relative segment that must not be requested, such as a private dot-directory or other administrative path.
- Apply the change and test a direct request to the segment and to a file nested below it.
Microsoft’s walkthrough also documents the corresponding AppCmd and configuration approach for administrators who manage IIS declaratively. Use the form appropriate to your deployment, but verify the resulting configuration at the site or directory where the request is filtered.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Block risky extensions
Request Filtering also exposes a fileExtensions collection. You can deny a specific extension, such as inc, when source-like files must never be returned. IIS can alternatively set allowUnlisted="false" and explicitly allow only the extensions the application is intended to serve.
A deny rule for one extension is narrow and usually easier to reason about. An allowlist is stronger, but it requires an inventory of every legitimate static and downloadable extension; missing one can make a valid feature fail. Introduce an allowlist only after checking the application’s assets, upload/download flows, and deployment-generated files.
Microsoft notes that a request blocked by extension filtering returns HTTP 404 with a filtering substatus. Record the substatus in your monitoring and logs so a policy denial is not mistaken for a missing file.
Understand IIS responses for hidden static files
When a client requests a hidden static file, IIS can return HTTP 404.9 – Not Found or an Access Denied message. Those responses indicate that IIS filtering or authorization stopped the request; they do not prove that the file is absent from disk. Check Request Filtering settings and the IIS logs before changing application code.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Use NTFS permissions for per-user access
Request Filtering is a public URL policy. If one authenticated user or service should be able to read a file while another must be denied, enforce that distinction with NTFS permissions and the application’s authorization model. Microsoft specifically cautions that the IIS application-pool identity must retain read permission for files the application needs to serve. Removing that permission can turn a legitimate application request into an access failure even when the URL is correctly configured.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Apache and IIS compared
| Decision point | Apache | IIS |
|---|---|---|
| Primary path control | mod_rewrite rule matching a path component that begins with a period |
Request Filtering hiddenSegments collection |
| Extension control | Use a separate FilesMatch policy for backups, source, configuration, logs, and SQL dumps |
fileExtensions; deny a named extension or set allowUnlisted="false" and allow known extensions |
| Standard exception | Explicitly exempt the required /.well-known/ paths in the rewrite conditions |
Define only the hidden segments that should be inaccessible; no broad dot-file exception is implied by Hidden Segments |
| Typical blocked response | The [F] flag returns a forbidden response |
Filtering can produce HTTP 404 with a filtering substatus; hidden static files can produce HTTP 404.9 or Access Denied |
| Per-user authorization | Keep application authorization separate from the public rewrite rule | Use NTFS permissions when access must vary by user; preserve application-pool read access |
| Configuration scope | Place the rule in the active server or directory authorization context and account for path normalization and routing | Apply Request Filtering at the site or directory selected in IIS Manager, or through the corresponding configuration/AppCmd method |
Validate the policy before calling it complete
Validation should use direct HTTP requests, not only a file browser or an internal filesystem check. Run the checks from a client that reaches the same public host and scheme as ordinary visitors.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Blocked dot-file: request a representative existing file whose name begins with a period, such as a deliberately controlled test file. Confirm that the server rejects the request and that the log records the filtering or rewrite decision.
- Nested dot-directory: request an existing file below a dot-prefixed directory. This verifies that the policy covers path components beyond the document-root level.
- Permitted discovery file: request a file under
/.well-known/that is intentionally public. Confirm that the exception allows it and that unrelated dot-paths remain blocked. - Normal public asset: request an ordinary image, stylesheet, script, or other known public file. Confirm that the new rule does not interfere with normal serving.
- Extension test on IIS: request a controlled file with each denied extension and record the HTTP status plus filtering substatus. If an allowlist is enabled, test every extension used by the application.
- Log review: compare access and error logs with the expected requests. A 404 caused by Request Filtering, a rewrite-forbidden response, and an application-generated 404 have different remediation paths.
Do not test by placing real credentials, production environment files, or database dumps in a publicly reachable directory. Use harmless fixtures that exercise the same filename and path patterns.
Troubleshoot common failures
The server still serves a dot-file
- On Apache, verify that
mod_rewriteis loaded and that the rule is in the configuration actually serving the host. Confirm that the request maps to an existing file or directory, because the supplied pattern tests%{SCRIPT_FILENAME}. - Check whether an application router or proxy changes the path before Apache evaluates it. Review the normalized URI and the effective configuration rather than the URL displayed in a browser alone.
- On IIS, confirm that the segment was added under the correct site or directory and that the request reaches that IIS instance rather than another proxy or server.
A required discovery document is blocked
Inspect the requested URI and compare it with the Apache exception for /.well-known/. Differences in nesting, trailing slash handling, or normalization can prevent a match. Narrowly correct the exception and retest a blocked dot-file so the fix does not create a new public path.
Legitimate application files return errors after enabling filtering
- An IIS extension allowlist may omit an extension used by a stylesheet, download, or generated asset. Review the application’s complete extension inventory before adding an allowlist, then permit only extensions that are intentionally public.
- NTFS changes may have removed read permission from the IIS application-pool identity. Restore the minimum read access required by the application rather than granting broad permissions.
- A rewrite rule may match a dot-prefixed virtual route that the application expects. Use the logs and route mapping to determine whether the target is a real file or directory, then design a narrowly scoped exception if the route is genuinely public.
Users see 404.9 or an unfamiliar Access Denied page on IIS
Those responses are consistent with IIS hidden-file filtering. Check Request Filtering and the IIS log substatus first. If the resource should be available only to selected users, move the decision to authentication, application authorization, or NTFS permissions instead of making the path globally public.
Quick Recap
Operational checklist
- Identify every dot-file and dot-directory that must never be public, including nested paths.
- Preserve only the
/.well-known/discovery files that the site intentionally publishes. - Apply Apache rules in the effective authorization configuration, or add IIS Hidden Segments at the correct site or directory scope.
- Decide separately whether backup, source, log, configuration, and SQL-dump extensions require filtering.
- Choose NTFS and application authorization when access must vary by user.
- Verify that the IIS application-pool identity can still read files the application serves.
- Test a blocked dot-file, a nested dot-directory, an allowed
/.well-known/file, and a normal public asset. - Record expected status codes and filtering details, then monitor logs for both policy denials and accidental blocks.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
