My employer maintains a server for several Drupal sites. They inherited these sites without having much expertise in Drupal. I'm more front end than back end so my knowledge of hosting is limited. My question relates to the folders that reside in the root folder alongside the Drupal site folders. I could tell that some folders didn't belong, such as 'backups' and 'libraries'. I moved those folders and there was no problem. (By the way I verified that some of these files could be called up in a browser.) There were two remaining folders I am not sure about. The 'logs' folder has server logs but the individual files cannot be called up in an anonymous browser. Does anybody know the rule as to where server log files belong and how to secure them? I do not see an htaccess file in this folder, BTW. The other questionable folder is a folder labelled 'internal', and it has database stuff in it, such as an 'aspnet_client' folder. I'm afraid to just move this file even though the content is several years old with no recent changes. That tells me it's not important, but I'm wondering if any server people can tell me this folder doesn't look right, it was probably stored there by mistake at one point as a backup.

Thanks in advance for your help.

  • There is no real answer to your question. In theory Drupal should only be used to write to either the public and/or private file system. However if any of your sites have custom modules, they could theoretically write anywhere (even outside of the web root). The folders you mention are not part of a default Drupal installation, but they could be the result of any of the contrib modules or something the previous maintainer wrote himself. Either leave the files be, or make a backup, delete them and cross your fingers. Commented Feb 15, 2017 at 18:43

1 Answer 1


The simple answer is: none. The public files folder is an area Drupal uses to store files. It shouldn't be manipulated manually or by non-Drupal processes (unless you're configuring an advanced workflow, really know what you're doing, and can accept the risk that Drupal could theoretically annihilate any "extra" files it finds as it has write perms).

If you're certain the folders you're talking about aren't managed by Drupal, and you don't need the contents, you can assume they're safe to delete.

Obviously you'll need to perform sanity checks to ensure other processes outside of Drupal don't rely on them first. Hopefully your infrastructure is documented (if not, now's the time to start)

FYI You can check whether individual files are managed by Drupal by interrogating the file_managed table.

  • By 'public' folder I mean the root server folder that is being served to the web, which includes a few separate Drupal sites. I know that Drupal sometimes refers to the sites/all/default/files as a 'public' folder. By 'public' I mean the entire server folder. Anyone with a browser can ping files in this folder. Maybe I have the wrong term. Anyway, I'm not aware of Drupal writing to any neighboring folder outside its own folder. And I'm sure we don't have an 'advanced workflow.' Thanks for the tip about checking the file_managed table.
    – P Tocco
    Commented Feb 15, 2017 at 18:29
  • Oh right, yeah there's not much to be said about that really. It's a publicly available folder, so make sure you only put stuff you want to be public in it. In a normal flow, Drupal will never write to the web root, so really you just need to audit what is an isn't part of Drupal in those files, decide whether they should be there, and delete if they shouldn't
    – Clive
    Commented Feb 15, 2017 at 18:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.