I'm working on a new installation of Drupal 10.2 and I noticed there's an .htaccess file in the files folder. This file is created automatically by Drupal. When I try to delete it, it gets created again.

The site looks like basic html with no CSS, but when I delete de file it goes back to normal until it gets created again and back to where I started.

I get 404 error in the browser developer tools for css and js files inside sites/default/files/css and sites/default/files/js

This is the content of the .htaccess file:

# Turn off all options we don't need.
Options -Indexes -ExecCGI -Includes -MultiViews

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php.c>
  php_flag engine off

Is there anything I need to change so this doesn't happen?

  • 1
    What does the web server access log indicate in these cases?
    – cilefen
    Jan 22 at 11:52
  • I couldn't find anything in the logs, but it looks like it had to do with the settings to aggregate CSS and JSS files. As soon as I turn them off the site went back to normal
    – Yusef A
    Jan 24 at 3:54

1 Answer 1


I managed to find a solution unrelated to the .htaccess file.

I turned off 'Aggregate CSS files' and 'Aggregate JS files' under admin/config/development/performance.

As soon as I did that the site went back to normal.

  • Aggregation is a performance optimization. Disabling it in production is not recommended. You should continue studying the problem.
    – cilefen
    Jan 24 at 12:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.