# Allow,Deny # First, all Allow directives are evaluated. At least one must match, or the request is rejected. # Next, all Deny directives are evaluated. If any matches, the request is rejected. # Last, any requests which do not match an Allow or a Deny directive are denied by default. # # Deny,Allow # First, all Deny directives are evaluated. If any match, the request is denied unless # it also matches an Allow directive. Any requests which do not match any Allow or Deny directives are permitted. # # *Match* -------------------- *Allow,Deny result* -------------------- *Deny,Allow result* # Match Allow only ----------- Request allowed ------------------------ Request allowed # Match Deny only ------------ Request denied ------------------------- Request denied # No match ------------------- Default to second directive: Denied ---- Default to second directive: Allowed # Match both Allow & Deny ---- Final match controls: Denied ----------- Final match controls: Allowed
The Allow and Deny directives are literal. If you Deny an ip address then it is denied. Trying to allow and deny the same ip address will not work and would be directly conflicting rules. With RewriteRules you could do x and then later in the htaccess code processing you could do y with x. The flow of rule processing would go from top to bottom of the ruleset. Since the Allow and Deny htaccess directives are literal then you cannot do the same type of thing that you can do with RewriteRules or Rewrite Conditions. An analogy of allow and deny directives would be a light switch. The light switch can be either turned On or Off – there is no inbetween or On and Off at the same time.