Error: Private files directory not fully protected

I received the following error in my Drupal 8 status report:

PRIVATE FILES DIRECTORY Not fully protected See for information about the
recommended .htaccess file which should be added to the private://
directory to help protect against arbitrary code execution.

The obsolete link provided shows no guidance for Drupal 8 or 9, only 7 and prior. I already have what I believe is a strict .htaccess file I’d found elsewhere in Drupal’s documentation. How can I fix this error in Drupal 8?

Drupal Answers Asked by glenviewjeff on December 28, 2020

2 Answers

2 Answers

Submit the admin form @/admin/config/media/file-system will also create this .htaccess file if your folders are setup correct.

Correct answer by Marcel on December 28, 2020

Per glbr, put the following in a .htaccess file in your private files directory.

# Deny all requests from Apache 2.4+.
<IfModule mod_authz_core.c>
  Require all denied

# Deny all requests from Apache 2.0-2.2.
<IfModule !mod_authz_core.c>
  Deny from all

    # Turn off all options we don't need.
    Options -Indexes -ExecCGI -Includes -MultiViews

    # Set the catch-all handler to prevent scripts from being executed.
    SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
    <Files *>
      # Override the handler again if we're run later in the evaluation list.
      SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003

    # If we know how to do it safely, disable the PHP engine entirely.
    <IfModule mod_php5.c>
      php_flag engine off
    <IfModule mod_php7.c>
      php_flag engine off

Answered by glenviewjeff on December 28, 2020

Add your own answers!

Related Questions

File field upload in modal/dialog

1  Asked on December 4, 2020 by ctrnz


How to pre-select items in a select with chosen

1  Asked on December 3, 2020 by jav


Update existing node (not created by Migrate) via Migrate 8.5.x

1  Asked on December 3, 2020 by vaibhav-rana


Secondary Tabs and views

1  Asked on December 2, 2020 by timwhelan


alter Suggestion box for apache solr autosearch

2  Asked on December 1, 2020 by anamika


User specific permission to add links to a menu

2  Asked on November 26, 2020 by mavicc


How to alter sort handler to keep existing order intact in views

1  Asked on November 18, 2020 by hiranya-sarma


Issue using Config Split on content types

0  Asked on November 18, 2020 by vecta


How to create simple confirmation page?

3  Asked on November 11, 2020 by mathewdragon


How do I add a template suggestion for a Views block?

2  Asked on October 21, 2020 by wbeasley


How to programmatically manage taxonomies?

1  Asked on October 15, 2020 by deny-dias


CSS-tags added using Display suite on products disappears

1  Asked on October 4, 2020 by anders-wallenquist


I have issue with commerce_order_load_multiple function

1  Asked on October 1, 2020 by user3686276


Why can’t I install even if I have the required PHP version?

0  Asked on September 13, 2020 by hendrik-kaiser


Ask a Question

Get help from others!

© 2022 All rights reserved.