I have this security report that is constantly saying:

Security warning: Couldn't write .htaccess file. Please create a .htaccess file in your private:// directory which contains the following lines:

Deny from all

#Turn off all options we don't need.
Options None
Options +FollowSymLinks

#Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006

<Files *>
  #Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off

I have this exact file in sites/all/default/files/private. what could be wrong? The private folder has the permissions set to 644.

  • What do you have your 'Private file system path' file path set to at /admin/config/media/file-system?
    – leexonline
    Apr 10, 2014 at 8:38
  • When you say sites/all/default/files/private do you really mean sites/default/files/private?
    – leexonline
    Apr 10, 2014 at 8:41

1 Answer 1


When you say sites/all/default/files/private I presume you mean sites/default/files/private.

I suggest deleting sites/default/files/private/.htaccess and setting the permissions of sites/default/files/private to 777 temporarily. Drupal should then be able to recreate the .htaccess file which should be exactly correct.

There are other reasons this can happen, I just can't remember off the top of my head sorry. I've had this same problem before.

  • Sorry yeah it's sites/default/files/private so I moved it outside drupal and my webroot Apr 10, 2014 at 13:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.