how to obfuscate 403 with 404
# with a defined whitelist of app contextroots or directories, rest all can be served with 404 using below rewrite rule
RewriteEngine On
RewriteCond %{REQUEST_URI} ^((?!\/app1\/).)*$
RewriteCond %{REQUEST_URI} ^((?!\/dir2\/).)*$
RewriteCond %{REQUEST_URI} ^((?!\/dir3\/).)*$
RewriteCond %{REQUEST_URI} ^((?!\/app2\/).)*$
RewriteCond %{REQUEST_URI} ^((?!\/xmlpserver\/).)*$
RewriteRule ^ - [L,R=404]