AllowOverride

AllowOverride is an Apache HTTP Server directive that controls whether per-directory configuration files, typically named .htaccess, can override settings defined in the main server configuration. It is used within a Directory context in the server’s configuration (such as httpd.conf or a virtual host block) and applies to the directory and its subdirectories.

The value of AllowOverride determines what kinds of directives may be overridden in .htaccess files. It can be set to None to disable overrides, All to permit all override-worthy directives, or to a list of directive categories such as Options, FileInfo, AuthConfig, and Limit. The exact categories available depend on the server version and module configuration. In newer Apache versions there is also a mechanism to refine overrides further, such as using AllowOverrideList to specify which directives may be overridden when AllowOverride All is in effect.

In practice, setting AllowOverride to None improves performance and security by avoiding per-request disk reads for .htaccess, while AllowOverride All provides flexibility for per-directory customization. A common pattern is to set AllowOverride None globally and enable overrides only for specific directories that require them, using more granular categories where appropriate.

Examples: In httpd.conf:

<Directory "/var/www/html"> AllowOverride None </Directory>

or

<Directory "/var/www/html"> AllowOverride All </Directory>

Security and maintenance: Because .htaccess files can override important directives such as authentication, access controls, and rewrite rules, allowing overrides should be restricted and regularly reviewed to balance flexibility with performance and security.