I have a .htaccess file in the files directory and the .htaccess file permission is 444.

On running security review , I get the following response

"The .htaccess file exists but does not contain the correct content. It is possible 
it's been maliciously altered."

Is this a security breach?

I am trying to fix out the security check but facing the above issue. I have even tried removing the .htaccess file and updated with that of .htaccess file(sites/default/files/.htaccess) from fresh drupal install.

Still It shows the same error. I would like to figure out the following issue.

I would also like to know the permissions which are assigned to .htaccess file and what should be the content inside it.?

  • This is the original .htaccess file github.com/drupal/drupal/blob/7.x/.htaccess, permissions should be 644 – Fons Vandamme Feb 11 '15 at 8:32
  • Hi thanks for reply. where should I add the .htaccess file . is it inside the sites/default/files – harshal Feb 11 '15 at 8:33
  • that .htaccess most be on your drupal root directory. this .htaccess should be on your files directory drupal.org/SA-CORE-2013-003 – shrish Feb 11 '15 at 8:51
  • Thanks @shirish but I am still facing the same issue and message when Run security review check – harshal Feb 11 '15 at 9:01
  • What security review are you running? Drupalgeddon? (drupal.org/project/drupalgeddon) Can you add a screenshot of the output of your security review. – Fons Vandamme Feb 11 '15 at 9:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.