I'm looking to force a 403 access denied response for an xml file in a directory outside of the default Wordpress install.

The url I'm trying to force the 403 response on looks like this mydomain.com/autodiscover/autodiscover.xml

I've tried modifying the default Wordpress htaccess file by adding a line to ignore the custom directory but it doesn't seem to work. When visiting the url I get a 404. I did create the directory and xml file and pushed them to our server.

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^(autodiscover)($|/) – [L]
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

<Files ~ "\.(xml)$">
    deny from all

Wondering if anyone has every run into this before and if they found a solution. My end goal would be to just force the 403 on the one file so my xml sitemaps don't get blocked as well.

Thanks in advance.

2 Answers 2


So to restate your question you want mydomain.com/autodiscover/autodiscover.xml to produce a 403, and your Wordpress installation is at mydomain.com/ ?

Then this should do it to match that specific file only:

RewriteRule ^autodiscover/autodiscover.xml - [R=403,NC,L] 
  • Yes, you are correct. Would that RewriteRule get added to where I have my current rule: RewriteRule ^(autodiscover)($|/) – [L]
    – brandozz
    Jul 15, 2020 at 16:37
  • Yes, it should go there
    – mozboz
    Jul 15, 2020 at 16:38
  • Added the line and cleared my sites cache but it's still throwing a 404. Any suggestions for trouble shooting?
    – brandozz
    Jul 15, 2020 at 16:50
  • Try a simpler rule until it matches to confirm your .htaccess is working. Try remove that <Files> section
    – mozboz
    Jul 15, 2020 at 18:09
  • I removed that but no luck.
    – brandozz
    Jul 16, 2020 at 4:09

The fix that worked was adding an htaccess file to the directory with the line below

ErrorDocument 403 default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.