1 file.inc file_htaccess_lines($private = TRUE)

Returns the standard .htaccess lines that Backdrop adds to file directories.

This .htaccess code block is replicated in files/.htaccess. If you update this code block then make sure you also update files/.htaccess.


$private: (Optional) Set to FALSE to return the .htaccess lines for an open and public directory. The default is TRUE, which returns the .htaccess lines for a private and protected directory.

Return value

A string representing the desired contents of the .htaccess file.:

See also


Related topics


core/includes/file.inc, line 543
API for handling file uploads and server file management.


function file_htaccess_lines($private = TRUE) {
  $lines = <<<EOF
# Turn off all options we don't need.
Options -Indexes -ExecCGI -Includes

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003

# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
  php_flag engine off
<IfModule mod_php7.c>
  php_flag engine off
<IfModule mod_php.c>
  php_flag engine off


  if ($private) {
    $lines .= <<<EOF

# Deny all requests from Apache 2.4+.
<IfModule mod_authz_core.c>
  Require all denied

# Deny all requests from Apache 2.0-2.2.
<IfModule !mod_authz_core.c>
  Deny from all


  return $lines;