Getting error "PHP files in the Drupal files directory can be executed." in Security Review v.7.x-1.3

Question

I am on Drupal 7.92. When I run Security Review I get the error "PHP files in the Drupal files directory can be executed." in Security Review v.7.x-1.3. The sites/default/files directory is set to 770 apache:apache.

I run the following command in sites/default/files to find any PHP files:

find . -name "*.php"

It returns nothing. Why am I getting this error, and how do I fix it?

Answer 1

Security Review actually places a PHP file in that directory and executes it, proving that PHP execution is possible. In addition Security Review checks for the existence and the contents of an .htaccess file in the files directory. On Apache web server a properly-configured .htaccess file there will prevent PHP execution.

So the most likely case is that .htaccess is missing or its contents are incorrect.