When hosting your website, you may come across the error message “Option FollowSymlinks not allowed here”. This problem often occurs when changes are made to the .htaccess file or when a pre-made .htaccess file is used that has other security settings predefined.
Cause of the FollowSymlinks error
The cause of this error message lies in the configuration of the .htaccess file, specifically the ‘Options +FollowSymlinks’ directive. This directive allows Apache to follow symbolic links (symlinks) that point from one file or directory to another. For security reasons, this function may be disabled on some servers.
Solution for the symlinks error
To resolve the error and restore your website’s functionality, replace the entry ‘Options +FollowSymlinks’ with ‘Options +SymLinksIfOwnerMatch’ in your .htaccess file. This entry allows Apache to follow symbolic links, but only if the file/directory and the link’s target have the same owner.
This is a more secure alternative, as it limits the ability of malicious users to exploit symlinks to gain unauthorised access to system files.
Background and security considerations
The restriction on the `FollowSymlinks` directive and the recommendation to use `SymLinksIfOwnerMatch` are linked to security considerations. `FollowSymlinks` could potentially be exploited to bypass security restrictions by accessing unauthorised areas of the server via symlinks.
`SymLinksIfOwnerMatch` minimises this risk by ensuring that symlinks are only followed if they lie within the account holder’s ownership scope. This helps to maintain the integrity and security of the hosting environment and protects against certain types of attacks aimed at compromising the server configuration.
By requiring the use of `SymLinksIfOwnerMatch` instead of `FollowSymlinks`, we help to ensure a more secure web environment for all users. Should you require further assistance or have any questions regarding the configuration of your .htaccess file, our support team will be happy to help.