The Order directive controls the default access state and the order in which Allow and Deny directives are evaluated. Allow The Deny directives are evaluated before the Allow directives. Access is allowed by default. Any client which does not match a Deny directive or does match an Allow directive will be allowed access to the server. Allow,Deny The Allow directives are evaluated before the Deny directives.
Access is denied by default.
Any client which does not match an Allow directive or does match a Deny directive will be denied access to the server. Only those hosts which appear on the Allow list and do not appear on the Deny list are granted access. This ordering has the same effect as Order Allow,Deny and is deprecated in favor of that configuration. Note that in all cases every Allow and Deny statement is evaluated. In the next example, all hosts in the apache.org domain are allowed access, except for the hosts which are in the foo.apache.org subdomain, who are denied access.