On Sat, Nov 05, 2016 at 10:45:09AM +1100, Michael Schams wrote: There's two things you're doing wrong (well, one wrong and one overly complicated). First, instead of trying to create a negated match, set the default for that directory to denied, and then allow matching files. That's less complicated, so easier to get right. Second, you seem to be confused about the difference between shell globbing chars (wildcards) and regular expressions. They look similar in some ways, but they're not the same. This is a very common point of confusion, so you should spend some time reading up on them both. The Unix & Linux Stack Exchange site has lots of good questions and answers on the topic, and there's always the bash and shell programming guides. In particular, jp?g does not mean 'jp followed by any char and then a g'. it means 'j followed by an optional p and then a g'. You want 'jpe?g' instead, for 'jp followed by an optional e and then a g' e.g. something like this: <Directory ... > Require all denied <FilesMatch "\.(?i:png|gif|jpe?g)$"> Require all granted </FilesMatch> </Directory> Useful reference material: bash and other command line stuff: http://tldp.org/ - lots of useful guides, howtos and faqs. http://mywiki.wooledge.org/BashGuide http://mywiki.wooledge.org/BashFAQ also run 'man bash' and search for "Pattern Matching" Regular expressions: http://www.regular-expressions.info/ http://www.rexegg.com/regex-quickstart.html Stack Exchange Q&A sites: http://unix.stackexchange.com/ and http://askubuntu.com/ if you use ubuntu http://serverfault.com/ http://webmasters.stackexchange.com/ Wikipedia: https://en.wikipedia.org/wiki/Regular_expression https://en.wikipedia.org/wiki/Wildmat craig -- craig sanders &lt;cas(a)taz.net.au&gt;