As per my knowledge the static files like css/js inside core/modules etc should be read by http server user. So normally I give read permission recursively to http user for directories like core, theme, modules etc. But these directory contains some .yml or .install files e.g drupal/web/core/modules/user/user.install which gets downloaded automatically when someone visits my site example.com/core/modules/user/user.install .

So is it okay to expose those files to public ? and what steps can be taken to avoid it ? I checked some popular sites they also expose those files. So bit confused.

Note: Drupal default .htaccess may take care of these thing for Apache server only but what about other servers like nginx ? However I think Drupal is hard coded to be used with Apache server only.

  • This is neither enabled by default, nore necessary. Drupal ships with a well-designed ~/web/.htaccess that "whitelists" static assets in /coreetc, don't fix things that aren't broken
    – Hudri
    Commented Nov 22, 2018 at 16:59
  • 1
    @Hudri please don't vote down if you have no appropriate answer for the question. I am using NGINX and it doesn't obey .htaccess files.
    – SkyRar
    Commented Nov 22, 2018 at 17:02
  • 1
    Voting isn't based on whether or not you know the answer to a question. But either way, @Hudri's comment does happen to implicitly answer the question. Drupal core sees fit to use a whitelist for the /core folder, so you can assume you should do the same in whatever web server you're using
    – Clive
    Commented Nov 22, 2018 at 17:07
  • 1
    @Clive Thanks. But I am not totally agree with Hudri . Because the question clearly states that if any security issue is there if I expose those files ?
    – SkyRar
    Commented Nov 22, 2018 at 17:14
  • 1
    That’s not official, it’s an Nginx recipe. There isn’t an officially supported nginx config. Perusio’s one is a good starting point, but some might argue a bit too packed with features that most won’t need
    – Clive
    Commented Nov 22, 2018 at 17:36

1 Answer 1



The web server (e.g. via apache's directive) needs to be able to read (not write) the index.php file (and occasionally others such as update.php), and also static files such as .css/.js, pdfs and images.

The php interpreter is not limited by directives and so most other files required by php do not have to be visible.

As Hudri said, leave the .htaccess files as they are, configure the server to notice them (AllowOverrides) and refer to an appropriate guide, such as: https://www.drupal.org/docs/develop/local-server-setup/linux-development-environments/installing-php-mysql-and-apache-under

  • Thanks. Can you please tell me what may be security issue if those files are exposed ? I see some popular sites also expose those files. So I am bit confused that upto what extent security risks are there ? I know it is a broad question. But you can give an example please.
    – SkyRar
    Commented Nov 22, 2018 at 17:23
  • SkyRar - Drupal 8, configured properly out of the box is pretty secure. Follow the guides until you know more about the topic.
    – rivimey
    Commented Nov 22, 2018 at 17:28
  • 2
    What’s with the “upvote this”, “don’t downvote this” on this one?! Votes should only be applied when the beholder thinks a post warrants them, not just because a question/answer/comment happens to have been posted. Asking for/against them is considered noise and not something we need to have taking up valuable brain space in the comments :)
    – Clive
    Commented Nov 22, 2018 at 17:31
  • 1
    @SkyRar a specific example would be arbitrary and I suspect not particularly helpful to you. Suffice to say you’d be exposing some of the code that runs the website, and/or its configuration. Having that information is likely to help a potential attacker more than it would hinder them, therefore it’s prudent not to allow that to happen.
    – Clive
    Commented Nov 22, 2018 at 17:35
  • When I visit "core/modules/user/user.install" on any of my sites I get a 403 from Apache.
    – Kevin
    Commented Nov 22, 2018 at 17:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.