I am unable to call PHP files inside the Drupal directory. My task is maintaining staff's old pages on the new platform. With pages written on clear HTML, there is no problem: I place files in a folder I created (domain.org/sites/default/files/share/staff_folder).

In sites/default/files/.htaccess I added DirectoryIndex share and now the link to the domain.org/sites/default/files/share/staff_folder/index.html can be used. When I import pages written in PHP, e.g. calling domain.org/sites/default/files/share/staff2_folder/index.php, I get a 403 error:


You don't have permission to access /sites/default/files/share/staff2_folder/index.php on this server.

While /sites/default/files/share/staff2_folder/index.html still works.

  • If the old pages are just simple html it might be better to just make it as a basic page in Drupal. – Matt Sep 16 '16 at 19:15
  • The problem appears with pages written on php only (may be on pearl or python, but I don't have any of them to try). And as I answered to Kevin, I need only link for outside usage. No use inside drupal. It will be staffs' own space to maintain. – MuKeP Sep 16 '16 at 20:17
  • Thanks, kiamlaluno, for higlighting text. Sorry "I can not into tags" :( – MuKeP Sep 16 '16 at 21:08
  • This isn't really a Drupal issue. Drupal bypasses any existing files, and since this is an existing file, and the error you are seeing is a server error and not a Drupal error, it shows that the problem isn't in Drupal, but rather your server configuration. – Jaypan Sep 17 '16 at 2:08
  • Jaypan, I understand this circumstance. It is connected to the structure of .htaccess file in the root of /www. But I don't know how to configure it for correct "portforward". That is why I tried asking at many resources. – MuKeP Sep 17 '16 at 3:04

This is the part of .htaccess, which controls the access to php files:

  # For security reasons, deny access to other PHP files on public sites.
  # Note: The following URI conditions are not anchored at the start (^),
  # because Drupal may be located in a subdirectory. To further improve
  # security, you can replace '!/' with '!^/'.
  # Allow access to PHP files in /core (like authorize.php or install.php):
  RewriteCond %{REQUEST_URI} !/core/[^/]*\.php$
  # Allow access to test-specific PHP files:
  RewriteCond %{REQUEST_URI} !/core/modules/system/tests/https?.php
  # Allow access to Statistics module's custom front controller.
  # Copy and adapt this rule to directly execute PHP files in contributed or
  # custom modules or to run another PHP application in the same directory.
  RewriteCond %{REQUEST_URI} !/core/modules/statistics/statistics.php$
  # Deny access to any other PHP files that do not match the rules above.
  # Specifically, disallow autoload.php from being served directly.
  RewriteRule "^(.+/.*|autoload)\.php($|/)" - [F]

You can see, how the access for statistics.php is allowed. You can add your own rules (at your own risk).


Just create the pages by going to Admin > Content > Add Content > Basic Page (or content type that is most applicable). There is no need to serve static PHP files within Drupal. Drupal is a content management system.

Knowing nothing about your content structure, it is up to you to attach fields to a content type for these pages that would best represent the data within them - use Drupal for its strengths, this is one of them. Revert all the changes to the .htaccess and apache conf files, it is not necessary.

For security reasons, you definitely do not want to have .php files in sites/default/files, a directory which may inadvertently be set to 777 permissions and open up multiple holes.

edit: I thought you said they were 'staff' web pages, but now I see that you might mean different sites the staff maintained. In which case you would want to look into multisite with Drupal, but with the same content management methodology applied.

  • In fact, I don't want to implement these pages in Drupal. We have only one hosting, that is why, I just want to give them new links. e.g. "/sites/default/files/share/staff2_folder/index.php" these links will not be used in Drupal, just outside. – MuKeP Sep 16 '16 at 20:13
  • Kevin, I just want to "portforward" access to the files inside Drupal directory, like it is done for *.html files. – MuKeP Sep 16 '16 at 21:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.