I have the following in my default/files/.htaccess file:

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006                                                                                                                                                                                    
Options None                                                                                                                                                                                                                                
Options +FollowSymLinks  

But I am still able to execute php files in my files folder. What is wrong with my .htaccess file or how do I even verify if my .htaccess file is even working.


I found the correct .htaccess file in another drupal install. The file should contain:

# Turn off all options we don't need.                                                                                                                                                                                                        
Options None                                                                                                                                                                                                                                 
Options +FollowSymLinks                                                                                                                                                                                                                                                                                                                                                                                                                                                                   

# Set the catch-all handler to prevent scripts from being executed.                                                                                                                                                                          
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006                                                                                                                                                                                     
<Files *>                                                                                                                                                                                                                                      

# Override the handler again if we're run later in the evaluation list.                                                                                                                                                                      
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003                                                                                                                                                                                   

# If we know how to do it safely, disable the PHP engine entirely.                                                                                                                                                                           
<IfModule mod_php5.c>                                                                                                                                                                                                                          
php_flag engine off                                                                                                                                                                                                                        

php files wont work now in the files folder.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.