I'm working on a new installation of Drupal 10.2 and I noticed there's an .htaccess file in the files folder. This file is created automatically by Drupal. When I try to delete it, it gets created again.

The site looks like basic html with no CSS, but when I delete de file it goes back to normal until it gets created again and back to where I started.

I get 404 error in the browser developer tools for css and js files inside sites/default/files/css and sites/default/files/js

This is the content of the .htaccess file:

# Turn off all options we don't need.
Options -Indexes -ExecCGI -Includes -MultiViews

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php.c>
  php_flag engine off

Is there anything I need to change so this doesn't happen?

  • 1
    What does the web server access log indicate in these cases?
    – mona lisa
    Commented Jan 22 at 11:52
  • I couldn't find anything in the logs, but it looks like it had to do with the settings to aggregate CSS and JSS files. As soon as I turn them off the site went back to normal
    – Yusef A
    Commented Jan 24 at 3:54
  • Do check on Drupal’s install requirements.
    – mona lisa
    Commented Apr 2 at 22:38

3 Answers 3


I had the same problem. My solution is this. In apache2.conf I have this setting:

<Directory />
Options FollowSymLinks
AllowOverride None
Require all granted

In my vhost.conf I have this setting:

<Directory /home/user-me/www/drupal/web/sites/default/files/>
Options -Indexes -ExecCGI -Includes -MultiViews
php_flag engine off

Now I can use js and css aggregation without my site breaks. With the setting in apache2.conf, .htaccess files are ignored.



I had the same problem with Drupal 10.2.6 installed via Installatron on shared Apache 2.4.59 hosting. The error_log file reported the following recurrent error:

[Thu May 23 09:13:50.872997 2024] [core:alert] [pid 14044:tid 47970348619520] [remote [IP_REDACTED]:36660] /home2/[USERNAME_REDACTED]/private_html/drupal10/sites/[MULTISITE_REDACTED]/files/.htaccess: Option Includes not allowed here, referer: https://[DOMAIN_REDACTED]/batch?id=3&op=start

To fix it I removed the -Includes directive as follows:

# Turn off all options we don't need.
# Options -Indexes -ExecCGI -Includes -MultiViews
Options -Indexes -ExecCGI -MultiViews

# (rest of file untouched)

I managed to find a solution unrelated to the .htaccess file.

I turned off 'Aggregate CSS files' and 'Aggregate JS files' under admin/config/development/performance.

As soon as I did that the site went back to normal.

  • Aggregation is a performance optimization. Disabling it in production is not recommended. You should continue studying the problem.
    – mona lisa
    Commented Jan 24 at 12:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.