Is there any security or operational problems if I do not have any .htaccess file in drupal root?

Question

I realise that having the .htaccess file in the root of my installation is probably the way the program is designed to run, but I was having some difficulties accessing the site, and then fixed the problem by deleting the .htaccess file in the root. But then it made me wonder if this was a good idea to leave my Drupal 7 installation without a .htaccess file in the root at all.

Is there any security or operational problems if I do not have any .htaccess file in drupal root? I imagine that I would have to put it back in order to enable clean URLs.

Answer 1

You may have some problems, depending on how Apache is configured.

People may be able to browse directly to some hidden files. Look at lines 6 and 73 in the .htaccess to see what it restricts.

People may be able to browse directories directly. See line 10.

The site may not work right if you accidentally put a file called index.html in the root. Line 20 makes index.php the primary file.

Clean URLs won't work. I am not 100% sure if image cache will, either.

There may be some PHP security issue, but the php_flag directives have been standard settings in php.ini for a several years now.

Are you on shared hosting? If so, the problem with the .htaccess could be the Options lines. Some hosts restrict these. Everything else should be feature checked the the <IfModule> directives.

It is possible to not have a .htaccess in the DOCROOT by placing the contents into the Apache config for the site, or in an include. On high volume sites, there are some performance gains from doing this (.htaccess is read each request, where Apache config is read once when it starts).

Answer 2

Adding to what MPD said, I think there are other two important parts in the .htacess file provided by Drupal:

• File caching Drupal says to the browser which files must be cached and how long.

  # Requires mod_expires to be enabled.
  <IfModule mod_expires.c>
    # Enable expirations.
    ExpiresActive On
  
    # Cache all files for 2 weeks after access (A).
    ExpiresDefault A1209600
  
    <FilesMatch \.php$>
      # Do not allow PHP scripts to be cached unless they explicitly send cache
      # headers themselves. Otherwise all scripts would have to overwrite the
      # headers set by mod_expires if they want another caching behavior. This may
      # fail if an error occurs early in the bootstrap process, and it may cause
      # problems if a non-Drupal PHP file is installed in a subdirectory.
      ExpiresActive Off
    </FilesMatch>
  </IfModule>
  

• Serving compressed JavaScript, and CSS files
  Drupal is able to return to the browser compressed files.

  # Rules to correctly serve gzip compressed CSS and JS files.
  # Requires both mod_rewrite and mod_headers to be enabled.
  <IfModule mod_headers.c>
    # Serve gzip compressed CSS files if they exist and the client accepts gzip.
    RewriteCond %{HTTP:Accept-encoding} gzip
    RewriteCond %{REQUEST_FILENAME}\.gz -s
    RewriteRule ^(.*)\.css $1\.css\.gz [QSA]
  
    # Serve gzip compressed JS files if they exist and the client accepts gzip.
    RewriteCond %{HTTP:Accept-encoding} gzip
    RewriteCond %{REQUEST_FILENAME}\.gz -s
    RewriteRule ^(.*)\.js $1\.js\.gz [QSA]
  
    # Serve correct content types, and prevent mod_deflate double gzip.
    RewriteRule \.css\.gz$ - [T=text/css,E=no-gzip:1]
    RewriteRule \.js\.gz$ - [T=text/javascript,E=no-gzip:1]
  
    <FilesMatch "(\.js\.gz|\.css\.gz)$">
      # Serve correct encoding type.
      Header set Content-Encoding gzip
      # Force proxies to cache gzipped & non-gzipped css/js files separately.
      Header append Vary Accept-Encoding
    </FilesMatch>
  </IfModule>
  

Those directives don't protect from security issues, but they increase the performance of the web site.
You can put those directives in a configuration file read from http.conf, if you have access to those files.

Generally speaking, removing the .htaccess file from the Drupal root directory is not a good idea, except when you can move those directive in another file.