This is a better
.htaccess to use:
# Turn off all options we don't need.
Options -Indexes -ExecCGI -Includes -MultiViews
# Set the catch-all handler to prevent scripts from being executed.
# Override the handler again if we're run later in the evaluation list.
# If we know how to do it safely, disable the PHP engine entirely.
php_flag engine off
php_flag engine off
.htaccess is the one that should have been placed in your private files directory by Drupal 8 (or 9) core. (Perhaps permissions on the private directory prevented Drupal from creating the file.)
The accepted answer above is adequate to quiet the warning from Drupal status report, but does not actually prevent the remote script execution exploit addressed in the original core security advisory from 2013.
I stand corrected. In the case of the private files directory, there's actually a bit more to it.
.htaccess I posted above (last April) contains "Apache htaccess directives to prevent execution of files in a location."
.htaccess is added to public file directories like
./sites/default/files/ to prevent remote execution of uploaded PHP scripts -- a vector for some very nasty exploits that can compromise not only your Drupal site, but in some cases your entire server.
But the very next method in
Drupal\Component\FileSecurity contains "Apache htaccess directives to block access to a location."
That section looks like this:
# Deny all requests from Apache 2.4+.
Require all denied
# Deny all requests from Apache 2.0-2.2.
Deny from all
.htaccess is the one which is necessary to prevent all remote access to a directory. In the case of the directories used for Drupal's
temporary:// stream wrapper file paths, it would seem prudent to add both of these.
Also, if you installed Drupal a long time ago and have been upgrading incrementally, it might be good to check the
.htaccess files in your public, private, temporary and config directories to make certain they are up to date. Sometimes when an older version is present, it prevents Drupal security hardening from adding the latest version.