I received the following error in my Drupal 8 status report:

PRIVATE FILES DIRECTORY Not fully protected See https://www.drupal.org/SA-CORE-2013-003 for information about the recommended .htaccess file which should be added to the private:// directory to help protect against arbitrary code execution.

The obsolete link provided shows no guidance for Drupal 8 or 9, only 7 and prior. I already have what I believe is a strict .htaccess file I'd found elsewhere in Drupal's documentation. How can I fix this error in Drupal 8?


2 Answers 2


Submit the admin form @/admin/config/media/file-system will also create this .htaccess file if your folders are setup correct.

  • I would suggest backing up then deleting the existing .htaccess in the private files folder, before doing the above.
    – Jaypan
    Jun 10, 2020 at 16:34
  • Could you elaborate what you mean by "saving the admin form?" Jun 11, 2020 at 15:51
  • Go to your-host.com/admin/config/media/file-system and submit that form.
    – Marcel
    Jun 12, 2020 at 11:20
  • If it doesn't work, make sure the folder is writable by Drupal. There would be an error message in the logs.
    – mbomb007
    Feb 4, 2022 at 20:02

Per glbr, put the following in a .htaccess file in your private files directory.

# Deny all requests from Apache 2.4+.
<IfModule mod_authz_core.c>
  Require all denied

# Deny all requests from Apache 2.0-2.2.
<IfModule !mod_authz_core.c>
  Deny from all

    # Turn off all options we don't need.
    Options -Indexes -ExecCGI -Includes -MultiViews

    # Set the catch-all handler to prevent scripts from being executed.
    SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
    <Files *>
      # Override the handler again if we're run later in the evaluation list.
      SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003

    # If we know how to do it safely, disable the PHP engine entirely.
    <IfModule mod_php5.c>
      php_flag engine off
    <IfModule mod_php7.c>
      php_flag engine off

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.