Following this guide: https://www.drupal.org/documentation/modules/file it says

"When you specify the private directory in admin/config/media/file-system it will automatically create the sub-directory & create a simple .htaccess file with Deny from all."

When you edit your settings.php and add the $settings['file_private_path'] = 'sites/default/files/private' after drush rc it doesn't create the .htaccess file in my sites/default/files/private and I do not know how the correct .htaccess should look so I could add it manually?

enter image description here,

enter image description here

enter image description here

  • In my memory this path needs to be absolute as in /var/www/mydrupal/sites/default/files/prv doesn't it? – leymannx Jul 11 '18 at 18:03


Deny from all
# Turn off all options we don't need.
Options None
Options +FollowSymLinks

This is a better .htaccess to use:

# Turn off all options we don't need.
Options -Indexes -ExecCGI -Includes -MultiViews

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
<IfModule mod_php7.c>
  php_flag engine off

This .htaccess is the one that should have been placed in your private files directory by Drupal 8 (or 9) core. (Perhaps permissions on the private directory prevented Drupal from creating the file.)

The accepted answer above is adequate to quiet the warning from Drupal status report, but does not actually prevent the remote script execution exploit addressed in the original core security advisory from 2013.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.