Give a false 404 Directory not found via .htaccess

[dlite922]

I have a framework where I usually have a /pub and /app folder and only give apache /pub. But unfortunately with a setup I have, my files are in the same directory as /app.

I know how to distable directory listing and peeking around (give access denied message), but I want to completely mask it. For instance...

With that first solution someone can guess that /app exists because he gets an access denied and that /foo doesn't exist because you get a "Not Found" message.

How can I fake the Not Found error?

....besides pasting Apache's html of that page in a index.html file, other than the fact that this is really messy (lots of sub directories) I'm looking for a cleaner solution.

[Dormilich]

you could always serve a "not found" or "access denied" page for non-public folders using mod_rewrite …

[dgreenhouse]

You could redirect any public access to that directory to a "not found" error via the .htaccess file using a rewrite condition and rule. That way, only the internal scripts have access the your /app directory, but as desired, web visitors won't see it.

Assuming you have an error document 404.php in your root, this might help:
(In the .htaccess file)

RewriteRule ^app/* /404.php