The module Security Review gives the report my
.htaccess in files directory is a security risk because says it has insufficient code to protect the site from anyone wanting to make php edits. However, have checked it with drupal org docs and I can see the .htaccess in files directory matches up with correct security script to keep out any such attempts.
Anyway I am trying to ascertain correct code input for .htaccess in the files directory. I remember there was a bug with this so maybe the security module is picking it up, I don't know.
# Turn off all options we don't need. Options None Options +FollowSymLinks # Set the catch-all handler to prevent scripts from being executed. SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006 <Files *> # Override the handler again if we're run later in the evaluation list. SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003 </Files> # If we know how to do it safely, disable the PHP engine entirely. <IfModule mod_php5.c> php_flag engine off </IfModule>