I will like to know what is the correct/better way to hide update.php file on the production server.

Currently when you try to access update.php file, Drupal shows default access denied page with info about how to edit settings.php file which I think is bit more revealing than is required.

Any suggestions or best practices ?

  • 3
    There's no best practice - whatever works for your needs. If you don't need it, delete it. If you only need it to be accessed on a local network, set that up through server config, and so on. Or realise that security through obscurity is pointless, and just leave it alone ;)
    – Clive
    Apr 14 '15 at 10:50

You can add the following line:

RewriteRule ^update.php$ - [R=404,NC,L]

to your .htaccess file so the web server returns a 404 rather than bootstrapping Drupal to show access denied.


Block update.php except from [YOUR_IP]: Put into .htaccess:

RewriteCond %{REQUEST_URI} ^/update.php
RewriteCond %{REMOTE_ADDR} !=[YOUR_IP]
RewriteRule .* - [F]

Also you can make the variable $update_free_access = FALSE; so with out admin login you are not able to access it. It is FALSE by default. or you can manage it from setting.php. I do not recommend that you should hide it because drupal release security update as required, so when you update your module or core drupal, you need the update.php. Hope this will help you out.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.