In my Drupal 8 site, the install.php file is accessible.

How can I restrict the access to that file?

  • I guess one way would be to amend your deployment script to remove this file from the artifact.
    – Kevin
    Sep 10, 2018 at 14:21
  • 1
    Just use your web server's rewrite rules to deny access
    – Clive
    Sep 10, 2018 at 14:35

2 Answers 2


In apache vhost:

RedirectMatch 403     "/(install|update).php" 

Or in htaccess change the part on top:

# Protect files and directories from prying eyes.
<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock)|web\.config)$|cron\.php|install\.php|update\.php|^(CHANGELOG|COPYRIGHT|INSTALL.*|LICENSE|MAINTAINERS|README|UPDATE).txt$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig|\.save)$">

Please note this htaccess also protects access to cron.php, update.php, web.config and txt files like /core/CHANGELOG.txt

  • 2
    Perfect. it works. But, i blocked it on server level Apr 21, 2022 at 7:05

How come you need it gone, is it necessarily a problem? Once the site is installed you just see a message informing you the installation is done.

If you really want it gone then once your site is installed delete the install.php file from the core directory. And then do that every time you update Drupal core

  • 7
    The install.php is not needed after the installation of Drupal. It has in the past been the cause of serious security bugs (like in 2012) and it shows for installed Drupal sites the version of your Drupal installation. So it is good to restrict access to it. Deleting it on every update is a hassle. May 14, 2019 at 8:22
  • Another alternative option would be to create a release branch in git, to be used as the basis for all releases, and remove the file there. Then any time you merge in changes from upstream, the file would get removed, prior to doing the release.
    – Matt V.
    Aug 30, 2022 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.