Security recommendation .htaccess

[Crunch]

The Site Security Recommendations recommend that you add the following to an .htaccess file and place in your folders:

#.htaccess to prevent unauthorized directory browsing or access to .php files
IndexIgnore */*
<Files *.php>
Order Deny,Allow
Deny from all
</Files>

Now, I've seen references throughout the forums here (after someone got hacked) to use the following to prevent directory browsing and access to files:

OPTIONS -Indexes -ExecCGI

My question, do both of these do the same thing? Is one more efficient than the other? Should they both exist in the .htaccess?

[Crunch]

OK. Looks like you should only use OPTIONS -Indexes -ExecCGI in a directory that has image files. It shouldn't be referenced in any other folder. Older posts (can't seem to find them anymore) had some conflicting information about this.

[Vger]

Well, you only need to use .htaccess to prevent Directory Browsing if that is permitted on the server your site is hosted on - and it should not be permitted for obvious security reasons.

Best advice is to contact the host and get them to turn it off server-wide.

Vger