documentation_complete: true

title: 'Restrict Other Critical Directories'

description: |-
    All accessible web directories should be configured with similarly restrictive settings.
    The <tt>Options</tt> directive should be limited to necessary functionality and the <tt>AllowOverride</tt>
    directive should be used only if needed. The <tt>Order</tt> and <tt>Deny</tt> access control tags
    should be used to deny access by default, allowing access only where necessary.

rationale: |-
    Directories accessible from a web client should be configured with the least amount of
    access possible in order to avoid unauthorized access to restricted content or server information.

severity: unknown

identifiers:
    cce: 27565-1
