2

I will like to know what is the correct/better way to hide update.php file on the production server.

Currently when you try to access update.php file, Drupal shows default access denied page with info about how to edit settings.php file which I think is bit more revealing than is required.

Any suggestions or best practices ?

Improve this question
1
  • 4
    There's no best practice - whatever works for your needs. If you don't need it, delete it. If you only need it to be accessed on a local network, set that up through server config, and so on. Or realise that security through obscurity is pointless, and just leave it alone ;)
    – Clive ♦
    Apr 14, 2015 at 10:50

5 Answers 5

Reset to default
4

You can add the following line:

RewriteRule ^update.php$ - [R=404,NC,L]

to your .htaccess file so the web server returns a 404 rather than bootstrapping Drupal to show access denied.

Improve this answer
1

Also you can make the variable $update_free_access = FALSE; so with out admin login you are not able to access it. It is FALSE by default. or you can manage it from setting.php. I do not recommend that you should hide it because drupal release security update as required, so when you update your module or core drupal, you need the update.php. Hope this will help you out.

Improve this answer
1
  • You still can perform database updates via Drush or while being logged in as admin. So always setting it to FALSE should be the recommended way.
    – leymannx
    May 26, 2022 at 8:23
0

Block update.php except from [YOUR_IP]: Put into .htaccess:

RewriteCond %{REQUEST_URI} ^/update.php
RewriteCond %{REMOTE_ADDR} !=[YOUR_IP]
RewriteRule .* - [F]
Improve this answer
0

Add below code in .htacces file in website root directory to restrict access to below files in production.

<FilesMatch "(^API|CHANGELOG|COPYRIGHT|INSTALL|LICENSE|PATCHES|MAINTAINERS|README|TODO|UPGRADE|UPDATE|CHANGES|install|update|authorize).*\.(md|txt|php)$">
  Order deny,allow
  Deny from all
</FilesMatch>
Improve this answer
0

In Drupal 7 set $update_free_access = FALSE in your settings.php file. This is the default. Performing database updates via drush updb is not affected by that.

/**
 * Access control for update.php script.
 *
 * If you are updating your Drupal installation using the update.php script but
 * are not logged in using either an account with the "Administer software
 * updates" permission or the site maintenance account (the account that was
 * created during installation), you will need to modify the access check
 * statement below. Change the FALSE to a TRUE to disable the access check.
 * After finishing the upgrade, be sure to open this file again and change the
 * TRUE back to a FALSE!
 */
$update_free_access = FALSE;

Since Drupal 8 set $settings['update_free_access'] = FALSE in your settings.php file. This is the default. Performing database updates via drush updb is not affected by that.

/**
 * Access control for update.php script.
 *
 * If you are updating your Drupal installation using the update.php script but
 * are not logged in using either an account with the "Administer software
 * updates" permission or the site maintenance account (the account that was
 * created during installation), you will need to modify the access check
 * statement below. Change the FALSE to a TRUE to disable the access check.
 * After finishing the upgrade, be sure to open this file again and change the
 * TRUE back to a FALSE!
 */
$settings['update_free_access'] = FALSE;
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.