XAMPP “Limit Not Allowed” in .htaccess

Quick Version:
In \xampp\apache\conf\httpd.conf
Find each occurrence of AllowOverride None
Change it to AllowOverride All

In \xampp\apache\conf\extra\httpd-vhosts.conf
Make the same change.

How I Have XAMPP Set Up

I have XAMPP, a full Apache web server for Windows, installed on my computer. Lets me develop and test web sites where only I can see my mistakes, then upload a working page to the Internet.

I have my web site files on a USB drive, so if I need to I can easily take it with me.

I have XAMPP Portable installed on that USB drive (connect the drive to any Windows computer, my testing web server is ready to go). I also have NotePad++ Portable (HTML editor), Filezilla Portable (FTP), and Firefox Portable (browser) with Firebug plugin (lot of features, invaluable for adjusting CSS until looks right, browser updates as I make changes, then copy correct CSS into NotePad++); all the tools I need for modifying web sites on-the-go.

I have XAMPP also installed on my computer, as a Windows Service, configured to use the web pages on that USB drive. Why both? Because I am nuts. I mean, so I could teach you how to do it that way! There may be some performance advantages to using the non-portable version, and probably some security advantages to using the Windows Service. Knowing how, it certainly isn’t harder to use. And I’m telling you how.

Change Configuration to Allow .htaccess More Control

The error messages “Limit Not Allowed” or (Options, DirectoryIndex, IndexIgnore, see http://httpd.apache.org/docs/2.4/mod/core.html#allowoverride for full list) is a configuration issue.

XAMPP default installation is configured for you as a server administrator, with full control over your testing environment. (XAMPP says clearly the default is not configured for security needed in a production server, but for testing.)

I want to be able to test the .htaccess files I write, just like clients would have (and like I have) on shared hosting accounts. But the default configuration blocks changing some things in .htaccess, that are better configured in server configuration files if you have access to them.

That requires some simple changes in a few configuration files.

Each web site is in a folder such as F:\xampp\htdocs\sitename\

With two separate installations of XAMPP, I need to make each of the changes in two places.

Changes to XAMPP configuration files need a XAMPP restart to take effect.

XAMPP with Apache as a Windows Service: Use Windows Control Panel, Administrative Tools, Services (tip: right click on that, pin to Start Menu to make a shortcut), restart the Apache service.

XAMPP “normal”: Use F:\xampp\xampp-control.exe or F:\xampp\xampp_start.exe and F:\xampp\xampp_stop.exe (tip: xampp-control is where you assign Apache and other components to run as a Windows Service, obviously don’t do this with a portable installation.) Note: Xampp-Control will not work on the Apache Windows Service.

Changes for XAMPP on C:

In C:\xampp\apache\conf\httpd.conf
Find each occurrence of AllowOverride None
Change it to AllowOverride All Nonfatal=All

In C:\xampp\apache\conf\extra\httpd-vhosts.conf
Make the same change.

Want more explanation?

httpd-vhosts.conf is the file where you tell XAMPP to make a sub-folder in XAMPP’s htdocs folder, behave as a web site. The file F:\xampp\htdocs\sitename\index.php should behave as http://somedomainname.com/index.php for your browser.

This should be there (probably is):

NameVirtualHost *:80


DocumentRoot "f:/xampp/htdocs"
ServerName localhost
ServerAdmin you@yourdomain.com

This says that if you type “localhost” into your browser address bar, (or more formally http://localhost/ ), it should display the file F:/xampp/htdocs/index.php (note: all folder names in XAMPP should follow web site (UNIX) standards, using forward slashes / instead of Windows style back slashes \ in all addresses. http://localhost/abcd.php should display f:/xampp/htdocs/abcd.php

You can define your own hosts. Some people use .local for their naming convention (http://www.youdomain.com on the Internet, http://www.yourdomain.local on your computer). Or use local.yourdomain.com, which should be looked for on your computer before on the Internet. I like a simpler one, since I’m doing it only for me: yd.c (Yes, you can name it anything you want, on your own computer only). Two or three letter abbreviation, and .c, you’d be amazed how typing 4 characters instead of a long domain name matters in developing and testing a web site.

You define “your own host name” in two places, one for XAMPP, one for Windows.

For Windows: edit your hosts file: C:\WINDOWS\system32\drivers\etc\hosts adding a new line for each “your own site” you make up (I show all the naming conventions, pick your preference and use it).

127.0.0.1 local.yourdomain.com
127.0.0.1 local.yourotherdomain.com
127.0.0.1 lc.c
127.0.0.1 www.yourdomain.local


Note: 127.0.0.1 as an IP address is a global convention for “this computer” (“the most-commonly used IPv4 loopback address”). Your hosts file probably has this line in it:
127.0.0.1 localhost
If it has some other IP address for localhost, use that IP address instead in your lines.

For XAMPP: Here’s what I have in httpd-vhosts.conf for one of my sites:

# reminder: must restart Apache for changes to take effect
DocumentRoot "f:/xampp/htdocs/lernerc"
ServerName lc.c
ServerAdmin you@yourdomain.com
ErrorLog f:/xampp/htdocs/lernerc/error_log
ScriptLog f:/xampp/htdocs/lernerc/error_log

  Options Indexes Includes FollowSymLinks MultiViews
  AllowOverride All Nonfatal=All
  Order allow,deny
  Allow from all

Notice the line AllowOverride All in the Directory section. That takes care of the “not allowed” problem. The Nonfatal=All is a bonus, gives you a descriptive warning instead of a 500:Server error if you make a typo for a .htaccess directive (though you still get a 500 Error for a syntax error in a valid directive).

see http://httpd.apache.org/docs/2.4/mod/core.html#allowoverride
also see AllowOverrideList http://httpd.apache.org/docs/2.4/mod/core.html#allowoverridelist

Changes for XAMPP on F:

In F:\xampp\apache\conf\httpd.conf
Find each occurrence of AllowOverride None
Change it to AllowOverride All Nonfatal=All

In F:\xampp\apache\conf\extra\httpd-vhosts.conf
Make the same change, in the Directory section of each VirtualHost definition, have the line AllowOverride All

Now your .htaccess files should work exactly like they would on your shared hosting account.