Hi my multisite site structure is, I have followed sub directory multisite mechanism

So in hosting server the url will be

http://123abc.hostring.com/mysitename1 http://123abc.hostring.com/mysitename2

I have pointed and configured with production url as,

www.mysitename1.com (http://123abc.hostring.com/mysitename1) www.mysitename2.com (http://123abc.hostring.com/mysitename2)

Everything working fine. But the private (Amazon S3) image styles cannot be created.

private file link http://www.mysitename1.com/system/files/styles/stylename/s3/myimage.jpg

It shows "Access Denied" error.

When I added below line in settings.php file the images styles has been created perfectly.

$conf["image_allow_insecure_derivatives"] = TRUE;

But I believe there are some security issues in that. Do I need to follow any other configuration instead of this?

Please advice.

1 Answer 1


It is not a critical security issue perse. But it can expose your site to DDOS attacks. So you can fairly enable this setting and you can disable it if you face any DDOS attacks that targets your site.

You can find more about this issue on https://www.drupal.org/SA-CORE-2013-002

Drupal core's Image module allows for the on-demand generation of image derivatives. This capability can be abused by requesting a large number of new derivatives which can fill up the server disk space, and which can cause a very high CPU load. Either of these effects may lead to the site becoming unavailable or unresponsive.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.