In my Drupal 8 site, the install.php file is accessible.

How can I restrict the access to that file?

  • I guess one way would be to amend your deployment script to remove this file from the artifact. – Kevin Sep 10 '18 at 14:21
  • Just use your web server's rewrite rules to deny access – Clive Sep 10 '18 at 14:35

In apache vhost:

RedirectMatch 403     "/(install|update).php" 

Or in htaccess change the part on top:

# Protect files and directories from prying eyes.
<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock)|web\.config)$|cron\.php|install\.php|update\.php|^(CHANGELOG|COPYRIGHT|INSTALL.*|LICENSE|MAINTAINERS|README|UPDATE).txt$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig|\.save)$">

Please note this htaccess also protects access to cron.php, update.php, web.config and txt files like /core/CHANGELOG.txt


How come you need it gone, is it necessarily a problem? Once the site is installed you just see a message informing you the installation is done.

If you really want it gone then once your site is installed delete the install.php file from the core directory. And then do that every time you update Drupal core

  • 2
    The install.php is not needed after the installation of Drupal. It has in the past been the cause of serious security bugs (like in 2012) and it shows for installed Drupal sites the version of your Drupal installation. So it is good to restrict access to it. Deleting it on every update is a hassle. – Hans Rossel May 14 '19 at 8:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.