How can I protect files in my web server directory from being accessed via the web?

There are two possible approaches here, which can also be combined:

File/Directory Permissions

On the proServer, the web server software (nginx or Apache) runs under the user ID www, while PHP scripts are executed under the user ID proserver. All files in the web server directory belong to the user proserver. In order for the web server to access a file or directory directly, the appropriate permissions must be set to “Everyone.” If, instead, a file is set to grant access only to the owner and, if applicable, the group, access is only possible via PHP scripts—for example, through the CMS being used.

Example:

In your web server directory, you have a directory named fileadmin/downloads containing files that should only be accessible via a download script with authentication. Set the file permissions for the directory as follows:

[proserver@vproXXXX:~]$ chmod 750 fileadmin/downloads
[proserver@vproXXXX:~]$ ls -ld fileadmin/downloads
drwxr-x---  2 proserver  proserver  2 Nov 22 11:58 fileadmin/downloads

Web Server Configuration

Apache

Apache allows you to restrict access to files or paths within the website using .htaccess files. Frameworks such as TYPO3 typically also provide suitable templates that you can use (after adapting them to the specifics of your own website, if necessary).

nginx

The nginx web server does not support .htaccess files; therefore, access restrictions must be configured within the actual web server configuration. The TYPO3 project provides suggestions for a sample configuration, which we will include in the file /usr/local/etc/nginx/Includes/typo3.conf for newly ordered proServers in the future. For existing proServers, you will need to copy this configuration into the appropriate file yourself; in either case, however, you should review the configuration to determine whether any adjustments are necessary for your website.