I use D7 with nginx and php5-fpm on Linux and get this security warning:

Public files directory Not fully protected

I see here that one needs to use this snippet in Apache's htaccess to resolve the issue:

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003

Just wondering what should be the nginx equivalent rule?

Update: I already have this in my nginx configs:

root   /path/to/drupal;

location ~ [^/]\.php(/|$) {
        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
        if (!-f $document_root$fastcgi_script_name) {
                return 404;
        try_files $uri =404;
        fastcgi_index index.php;
        include fastcgi_params;
  • I have this strange suspicion that Drupal may test for specific rules, not for their effect. Of course I;ll be glad to know if I'm wrong.
    – Mołot
    May 30, 2014 at 6:33

1 Answer 1


The .htaccess file won't have any effect in Nginx. You'll need to add your own rules to prevent PHP execution in the files directory.


# Allow access to index.php only
location = /index.php {
  include fastcgi.conf;

# Any other attempt to access PHP files returns a 403.
location ~ \.php$ {
  return 403;

However, to fix that error message, you can actually just delete the old .htaccess file and Drupal will recreate a new correct one.

Note: the check is in system_requirements with the line

if (!file_exists($htaccess_file) || !($contents = @file_get_contents($htaccess_file)) || strpos($contents, 'Drupal_Security_Do_Not_Remove_See_SA_2013_003') === FALSE) { 

It only checks for that line, Drupal doesn't currently validate an actual PHP request to the relevant directory to test the handler.

  • So, was I right to guess that Drupal tests for the presence of .htaccess, not for the safety itself? :(
    – Mołot
    May 30, 2014 at 7:34
  • @David I have a more complicate rule. Just not sure if that suffice. Please see the updated question.
    – Godo
    May 30, 2014 at 8:04
  • 1
    @Molot, indeed. It appears the check is in system_requirements with the line if (!file_exists($htaccess_file) || !($contents = @file_get_contents($htaccess_file)) || strpos($contents, 'Drupal_Security_Do_Not_Remove_See_SA_2013_003') === FALSE) { It only checks for that line, Drupal could instead for example, create and request an arbitrary PHP file in the files directory to validate access. May 30, 2014 at 8:49
  • Consider adding this to your answer - comment by @Godo shows it's confusing and people may expect that if config is OK, warning will disappear.
    – Mołot
    May 30, 2014 at 8:59
  • @Molot, I was not confused about role of .htaccess in nginx. I just wanted to make sure that my nginx configs is secure enough with respect to these vulnerabilities.
    – Godo
    May 31, 2014 at 4:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.