vendor directory displays 404 error instead of 403

[mirtov]

Hi everyone. I'm using whmcs 8.12.1 on cpanel with apache. when trying to open any directory or file with my.domain.com/vendor/  a 404 error is displayed instead of 403 error and the vendor .htacesss is kinda ignored. Meanwhile the admin directory .htaccess is working fine. By removing the parent default .htaccess in the public_html which disables the user friendly urls of whmcs , this issue gets resolved.

I have tried modifying public_html .htaccess RewriteCond to exclude the vendor folder which wasn't successful. Any recommendation is appreciated.

[WHMCS Danny]

Yes, this behavior is expected. The /vendor/ directory in WHMCS contains core dependency files and is not intended to be accessed directly via the browser. For security reasons, WHMCS restricts access to this directory, and attempting to access it should result in a 404 error rather than a 403. This is by design to prevent exposure of sensitive files.

 

The .htaccess file inside the /vendor/ directory is part of this protection, but depending on your server configuration, the parent .htaccess in public_html and Apache’s rewrite rules may also influence how errors are handled.

Removing or modifying the parent .htaccess can interfere with WHMCS’s routing and URL handling, which is why you noticed a change in behavior when doing so.

In general, you should not need to access anything inside /vendor/ via the browser, and it’s best to leave the default  .htaccess WHMCS rules in place to ensure WHMCS functions securely and correctly.

These are the stock WHMCS Rules: https://docs.whmcs.com/8-13/system/general-settings/general-settings-general/#whmcs-rules

 

I hope this information helps.