I am on Drupal 7.92. When I run Security Review I get the error "PHP files in the Drupal files directory can be executed." in Security Review v.7.x-1.3. The sites/default/files directory is set to 770 apache:apache.

I run the following command in sites/default/files to find any PHP files:

find . -name "*.php"

It returns nothing. Why am I getting this error, and how do I fix it?

  • What are the contents of the .htaccess file that is in the files directory?
    – cilefen
    Sep 27, 2022 at 11:33

1 Answer 1


Security Review actually places a PHP file in that directory and executes it, proving that PHP execution is possible. In addition Security Review checks for the existence and the contents of an .htaccess file in the files directory. On Apache web server a properly-configured .htaccess file there will prevent PHP execution.

So the most likely case is that .htaccess is missing or its contents are incorrect.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.