XAMPP on Windows 7: Solving “client denied by server configuration” VirtualHost Error CodeUnit 05 FEB 2013

I don’t normally use Windows as my development environment, but after being handed a Windows 7 Fujitsu laptop at work, I set about getting my development environment up and running as fast as possible. XAMPP appears to be a popular way of setting up an Apache, MySQL and PHP stack, so I duly installed and then whipped open the C:\xampp\apache\config\extra\httpd-vhosts.conf file in order to add all my virtual hosts.

Nothing too complicated in there, pretty much only defining a DocumentRoot and ServerName directive, along with a simple Directory block containing an Order and an Allow directive. Next up with the C:\Windows\System32\drivers\etc\hosts file which was edited to allow for my subdomain and that should have been that. I fired up the XAMPP console, started both Apache and MySQL, and pleasingly http://localhost/ worked first time in my browser. Then I attempted to access my virtualhost – and nothing. Or rather a 403 denied access error message courtesy of my browser.

What followed was more than a hour of searching and tinkering with my setup, exploring folder security properties, directory name structures, config file alterations, all to no avail. Instead the “client denied by server configuration” error continued to taunt me at every turn.

I went to bed a frustrated man, and the next morning after an early rise and shine, I pulled out my chair and tackled the problem anew. And success!

The problem lies in the restrictive XAMPP httpd.conf file where it specified the “default” with a very restrictive set of features, the troublemaker here being a Directory block containing “Require all denied” (an authentication feature rolled out with Apache 2.4). What this means is that all incoming requests are denied. So back to our virtualhost specification, where we need to edit our Directory block and add a new rule to override the default setting.

Now we could go for “Require all granted”, but this is a little bit too open and not necessarily a practice that should be encouraged if you don’t need it. Instead, because this is for my local development environment, I’ll open up my vhost for the internal IP of, using the “Require ip xxx.xxx.xxx.xxx” directive.

So now my vhosts.conf entry looks like this:

<VirtualHost *:80>
DocumentRoot "C:\vhosts\surveythumb"
ServerName surveythumb
DirectoryIndex index.php
<Directory "C:\vhosts\surveythumb">
AllowOverride none
Require ip
Order allow,deny
Allow from all


Related Posts:

About Craig Lotter

South African software architect and developer at Touchwork. Husband to a cupcake baker and father to two little girls. I don't have time for myself any more.

  • Kate

    Thanks! You saved me from a headache!

    • Seriously though, you will not believe the size headache this gave me in the first place!

  • Conzo

    Thank you so much! I thought I was going mad :)