Apache · Configuration and operations
How do Directory, Location and Files sections differ?
Short answer
Directory sections apply to filesystem paths, Location sections apply to URL paths, and Files sections apply to filenames. Use Directory for on-disk controls and Location for behaviour independent of the filesystem.
Apache merges configuration in a defined order. Directory and .htaccess settings are applied first, then Files, then Location. A Location section can therefore override a Directory setting for the same request, which surprises people who assume filesystem scope always wins.
<Directory "/var/www/app">
Options -Indexes +FollowSymLinks
AllowOverride None
Require all granted
</Directory>
<FilesMatch "\.(env|ini|log|sql)$">
Require all denied
</FilesMatch>
<Location "/server-status">
SetHandler server-status
Require ip 10.0.0.0/8
</Location>When to use which
- Directory: permissions and options for a real directory tree
- Location: endpoints that do not map cleanly to a file, such as proxied APIs
- Files: block or permit specific filenames wherever they appear
- DirectoryMatch, LocationMatch and FilesMatch: regex variants, use sparingly
- Proxy: configuration for requests forwarded by mod_proxy
Prefer Directory for authorization on static content because the check is tied to the actual path. Use Location for proxy endpoints and handler mounts. Regex sections are powerful but easy to over-match, so anchor patterns and test with real URLs.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1Why can a Location override a Directory directive?
- 2When would you use FilesMatch?
- 3What does AllowOverride None change?
- 4How do you protect a proxied endpoint that has no filesystem path?
Say it in the interview
Directory works on filesystem paths, Location works on URLs, and Files works on names. Merge order puts Location after Directory, so Location can override filesystem settings. I use Directory for static trees and Location for proxy endpoints. Regex variants are useful but I anchor them and test against real requests.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Apache mock interview and get scored feedback on depth, clarity and confidence.