I've developed a site that uses various image styles to export images to an iPhone (linked from a XML export document). This worked perfectly fine on my own development server with Linux/Apache.

The site is now currently hosted on a shared hosting environment, which uses Windows/IIS6. (yeah, strange; it is not my decision as you can assume ;).)

The problem now is that the image_style URLs for new images (existing images work) lead to a 404 error page, which is directly served by IIS. However, clean URLs worked fine out of the box and "normal" 404 pages are displayed by Drupal.

So, an URL like http://example.org/does_not_exist shows the typical site not found error, served with Drupal but http://example.org/sites/default/files/styles/command_image/public/Chrysanthemum_0.jpg shows the IIS 404 page.

The site is using the public file system for these images and the path is correct; it does work fine for existing images, which I uploaded together with the rest of the site during the initial deployment on that server.

Do you have any idea?


2 Answers 2


Ok, I figured it out.

The problem was that there were two .htaccess files. One in the top level, that contains most of the configuration and one in sites/default/files, which is security related (avoid execution of php files and similar) and contains just this:

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
Options None
Options +FollowSymLinks

Now the difference seems to be that in Apache, both files seem to be combined (the one in sites/default/files inherits everything from the top-level one). This does not happen with the ISAPI_Rewrite module that seems to handle the Apache/IIS .htaccess compatibily.

I fixed this by copying the content of the top-level directly into the file in sites/default/files, below the existing content. Additionally, I had to change the RewriteBase so that it included the index.php file in the correct directory.

The header of the changed .htaccess file now looks like this:

# From the original .htaccess file, do not remove.

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
Options None
Options +FollowSymLinks

# Apache/PHP/Drupal settings:
# (copied from /.htaccess)

Content of the top level .htaccess file here comes here...

And the part that I changed now looks like this:

# Modify the RewriteBase if you are using Drupal in a subdirectory or in a
# VirtualDocumentRoot and the rewrite rules are not working properly.
# For example if your site is at http://example.com/drupal uncomment and
# modify the following line:

So when Drupal is installed in a sub directory, insert your folder name. If not, you can leave this part commented out.

I found this thanks to the (unecessarly long) blog post at http://www.caspianit.co.uk/imagecache-wrong-path/

Note: Simply deleting the .htaccess file in sites/default/files did work too, however, that removes the security relevant SetHandler setting. I however doubt this has any effect in IIS anyway...

  • Thank you for having provided helpful tips on the issue. I make an extensive use of them.
    – user4343
    Dec 5, 2011 at 7:46

Is /sites/default/files/styles/command_image/public/Chrysanthemum_0.jpg present on the file system? If so, there may be a permission issue while fetching the image. If not, there may be a permission issue while generating and writing the image. Are there any errors in the Drupal log page?

  • Thanks for answering, I've checked the logs but didn't find anything apart from errors about files that couldn't be deleted because they don't exist. The error is about the original file, so I don't think it is relevant.
    – Berdir
    May 30, 2011 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.