What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Apache reports order not allowed here when it reads an Order directive in .htaccess but the directory policy does not permit that directive’s override class. The usual repair is to edit the matching site-level <Directory> block and allow the Limit class, rather than enabling every possible override. On Apache 2.4, you should also plan to replace the legacy rule with a Require-based rule when you control the server configuration.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
A failed parse commonly produces an HTTP 500 response because Apache cannot build a valid configuration for the request. The error is a server-policy problem, not proof that the access rule itself is logically wrong.
As an Amazon Associate I earn from qualifying purchases.
What “Order not allowed here” means
Order is supplied by Apache’s mod_access_compat module. It is the old host-access syntax used with directives such as Allow from all and Deny from all. In .htaccess context, Apache classifies Order under the Limit override class.
The server administrator decides which classes a directory’s .htaccess file may use with AllowOverride. Apache’s default is None. If the applicable directory policy does not include Limit, Apache can read the file but rejects the Order line during parsing. That is the specific condition behind the message.
#1 Best Overall
Why the result is often a 500 error
Apache parses configuration before it serves the request. A disallowed directive is a configuration error, so the request may end in HTTP 500 rather than a normal access-denied response. The exact file path and line number are normally written to the Apache error log.
Do not confuse rejection with an ignored file
If both AllowOverride and AllowOverrideList are None, Apache ignores .htaccess files altogether. That situation differs from Order not allowed here: the latter shows that Apache is processing the file and then refusing a directive under the active policy. If you expected another rule in the same file to work, verify which of these two cases applies.
Free tools Windows power users keep installed
One-click scans. No signup required.
Fix the error safely, step by step
1. Capture the exact log entry
- Reproduce the failing request once.
- Immediately open the Apache error log for the affected virtual host or server.
- Record the complete message, including the
.htaccesspath and line number.
The path matters because Apache may be applying a different policy to a parent directory, a document root, or an included virtual-host configuration than the one you first inspect.
2. Find the matching <Directory> block
Locate the server or virtual-host configuration whose <Directory> section covers the directory containing the failing .htaccess. Apache permits AllowOverride only in a non-regular-expression <Directory> section. A policy in an unrelated directory block will not authorize the file.
For a site whose document root is /var/www/example, the relevant block may look like this:
Rank #2
- Used Book in Good Condition
<Directory "/var/www/example">
AllowOverride Limit
</Directory>Use the actual document-root path and preserve any other override classes required by the application. Do not change the global root policy merely because that is the first <Directory> block you find.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →3. Permit the narrow class required by the file
If the file intentionally contains legacy rules such as Order allow,deny, Allow from all, or Deny from all, add Limit to the applicable AllowOverride setting. The smallest useful change is preferable to a blanket setting.
For example:
<Directory "/var/www/example">
AllowOverride Limit
</Directory>If the application also uses rewrite directives, the same file may require the FileInfo class. Include every class required by directives that are actually present; replacing an existing list with only Limit can make unrelated rules fail.
4. Reload using the installation’s normal method
Apply the configuration through the operating system and Apache package method used on that server, then reproduce the request. Inspect the error log again. A successful reload does not prove the access rule has the intended effect, so test both an allowed request and a request that should remain blocked.
Do not assume a reload or test has occurred merely because the configuration file was edited. The fix is complete only after Apache accepts the policy and the protected URL behaves as intended.
Choose between legacy compatibility and modern authorization
When retaining Order is reasonable
Keeping the old syntax can be appropriate during a controlled transition, when an existing application depends on its exact semantics, or when a vendor-maintained configuration has not yet been converted. In that case, enable Limit for the specific site directory and leave the rule set coherent.
Why Apache 2.4 favors Require
Apache 2.4 marks Allow, Deny, and Order as deprecated. The Apache access-control guide recommends the authorization framework built around Require. Common equivalents include:
Require all grantedto allow every client.Require host example.comto authorize clients by host name.Require ip 192.0.2.0/24to authorize a network or address range.
A migration should translate the complete access rule for the section, not just replace one line while leaving contradictory legacy directives behind. Apache specifically discourages mixing the old access-compatibility directives with the new Require directives. Validate the resulting behavior after conversion, because ordering and grouping can change the meaning of a rule.
Override implications of a modern rule
If the replacement is placed in .htaccess, the directory policy must allow the authorization directives used by that file, such as the appropriate authorization override class. If you can edit the virtual-host or directory configuration directly, placing the rule there avoids relying on per-directory overrides and gives the administrator a single authoritative policy.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhy AllowOverride All is usually the wrong first fix
AllowOverride All enables every directive that is valid in .htaccess context. It may make the immediate error disappear, but it grants a much broader configuration surface than one legacy access rule needs. Broad overrides can let files deployed beneath the directory change authentication, rewriting, access control, or other behavior that the server owner intended to keep centralized.
Apache’s core guidance says to keep the root <Directory "/"> restrictive for security and performance. Change the block for the actual site directory instead, and allow only the classes required by the directives in that application’s file. A practical policy might combine Limit with FileInfo when both legacy access rules and rewriting are present, but the exact list must follow the file’s contents.
Shared-hosting users: what you can and cannot change
On shared hosting, customers generally cannot edit the virtual-host or <Directory> configuration that controls AllowOverride. Editing the application’s .htaccess alone cannot grant a class that the provider has disabled.
Information to send support
- The complete error-log line, including the path and line number.
- The document-root directory that contains the file.
- The directive that triggers the error, such as
Order allow,deny. - The Apache major version, if the provider exposes it.
Ask whether the provider can enable AllowOverride Limit for the document root, or whether an approved modern authorization directive can be enabled instead.
If the provider will not change the policy
You have three practical choices: remove the legacy directive if it is unnecessary, rewrite the access rule using directives the host explicitly permits, or move the site to hosting that supports the required Apache configuration. Do not replace the line with a guessed directive; a syntactically valid rule can still be ignored or rejected under the provider’s policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting branches after the first change
The same “not allowed here” message remains
- Confirm that you edited the
<Directory>block matching the file’s real path, not a similarly named virtual host. - Check that the new configuration was actually loaded by Apache.
- Look for a later or more specific directory policy that still omits
Limit. - Verify that the directive is spelled and capitalized correctly:
Order,Allow, andDenybelong to the legacy access-compatibility module.
The 500 error changes to a different directive error
That usually means Apache moved past Order and found another directive whose class is not enabled. Review the entire .htaccess file and add only the additional class required by that directive. Rewrite rules commonly need FileInfo; authorization rules may require the class appropriate to the authorization syntax being used.
Best Value
- Used Book in Good Condition
The site loads but access behavior is wrong
Check whether old and new authorization systems were mixed during migration. Convert the full rule for that location to one coherent model, then test an allowed client, a denied client, and any host or IP exceptions. Also check whether a parent directory or virtual-host rule is contributing an additional requirement.
The file appears to have no effect
If Apache is not reporting a parse error and none of the file’s behavior changes, inspect whether both AllowOverride and AllowOverrideList are None. In that configuration Apache ignores the file, so the solution is a server-policy change rather than a different line inside .htaccess.
Recommended Free Tools
Fix options compared
| Approach | Apache version fit | Access needed | Security scope | Migration risk |
|---|---|---|---|---|
Enable Limit for the site directory |
Legacy compatibility, including existing configurations using Order |
Server or virtual-host administrator | 限定 to the required override class | Preserves existing rule semantics |
Enable every override with AllowOverride All |
Broad compatibility | Server or virtual-host administrator | Broader than necessary; increases the directives available to .htaccess |
Lowest immediate editing effort, highest policy exposure |
Rewrite the rule with Require |
Apache 2.4-native authorization | Administrator, or a host that permits the needed authorization override | Can be kept narrowly scoped in the directory or virtual-host policy | Requires coherent conversion and behavior testing |
| Ask a shared host to change the policy | Depends on the provider’s Apache configuration | Provider support rather than customer-level server access | Controlled by the provider’s approved classes | Depends on provider approval; otherwise the rule must be removed or rewritten |
The first option is the smallest repair when an existing file must continue using Order. The third is the forward-looking choice for Apache 2.4 when you control the configuration and can test the conversion.
Prevention checklist
- Keep the root
<Directory "/">block restrictive. - Set override permissions on the actual site directory, not globally.
- Match each
.htaccessdirective to the minimum override class it needs. - Avoid new configurations that depend on deprecated
Order,Allow, andDenydirectives. - Do not mix legacy access-compatibility rules with
Requirerules in one authorization section. - After every change, reload Apache, reproduce the request, read the error log, and test both permitted and blocked cases.
The durable fix is therefore specific: authorize the directive class in the matching site-level policy, or replace the legacy rule with a coherent Require configuration on Apache 2.4. Broadening the entire server to AllowOverride All is not required to resolve this error.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
