Answers.Body: <p>I found a solution. But thanks @Demerit, you gave the start. I made the assumption that the configuration <code>.htaccess</code> is done differently for Apache 2.2. And the drupal <code>.htaccess</code> gave some inspiration. I created the following file</p>
  
  <pre><code>&lt;Files "*"&gt;
    Require all denied
  &lt;/Files&gt;
  </code></pre>
  
  <p>And that works. Because there is already a .htacess file CiviCRM does not overwrite it.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-10-29T13:30:43.933Z
Answers.LastActivityDate: 2018-10-29T13:30:43.933Z
Answers.UserDisplayName: Kainuk - CiviCooP
Answers.Body: <p>It's possible that the config for the virtual host/Directory does not allow .htaccess override for the Limit directive type, and so is ignoring the Order commands.</p>
  
  <p>See <a href="https://httpd.apache.org/docs/2.2/mod/core.html#allowoverride" rel="nofollow noreferrer">https://httpd.apache.org/docs/2.2/mod/core.html#allowoverride</a></p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-07-25T19:02:21.043Z
Answers.LastActivityDate: 2018-07-25T19:02:21.043Z
Answers.UserDisplayName: Demerit
Body: <p>On the <code>civicrm/a/#/status</code> the security message <em>The CiviCRM debug log should not be downloadable</em> is displayed. And the complaint is correct, I am able to download the log file. But CiviCRM does generate the correct <code>.htaccess</code> file in de log directory in the following format</p>
  
  <pre><code>&lt;Files "*"&gt;
    Order allow,deny
    Deny from all
  &lt;/Files&gt;
  </code></pre>
  
  <p>The used configuration is CiviCRM 5.3.1, Drupal 7.0 and Apache/2.2.15.</p>
  
  <p>The <code>.htaccess</code> file is seen by apache. I tested this by making a syntax error in the file. That is reported by the webserver.</p>
  
  <p>Does someone has a hint to get it working again.</p>
  
Tags: <security><logs>
Title: The CiviCRM debug log should not be downloadable - generated .htaccess seems ok
ThreadText: # The CiviCRM debug log should not be downloadable - generated .htaccess seems ok
  
  (Asked by: username_0 on 2018-07-25)
  
  On the `civicrm/a/#/status` the security message *The CiviCRM debug log should not be downloadable* is displayed. And the complaint is correct, I am able to download the log file. But CiviCRM does generate the correct `.htaccess` file in de log directory in the following format
  
  ```
  <Files "*">
    Order allow,deny
    Deny from all
  </Files>
  
  ```
  
  The used configuration is CiviCRM 5.3.1, Drupal 7.0 and Apache/2.2.15.
  
  The `.htaccess` file is seen by apache. I tested this by making a syntax error in the file. That is reported by the webserver.
  
  Does someone has a hint to get it working again.
  
  **Tags:** security, logs
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_0 on 2018-10-29. Score: 1
  
  I found a solution. But thanks @username_1, you gave the start. I made the assumption that the configuration `.htaccess` is done differently for Apache 2.2. And the drupal `.htaccess` gave some inspiration. I created the following file
  
  ```
  <Files "*">
    Require all denied
  </Files>
  
  ```
  
  And that works. Because there is already a .htacess file CiviCRM does not overwrite it.
  
  
  ---
  
  ### Answer by username_1 on 2018-07-25. Score: 1
  
  It's possible that the config for the virtual host/Directory does not allow .htaccess override for the Limit directive type, and so is ignoring the Order commands.
  
  See <https://httpd.apache.org/docs/2.2/mod/core.html#allowoverride>
  
  
  ---
  
  