Answers.Body: <p>Preventing access to those files should be taken care of by <code>.htaccess</code> files.</p>
  
  <p>You should have <code>.htaccess</code> files under <code>files/civicrm/ConfigAndLog</code>, <code>files/civicrm/upload</code>, <code>files/civicrm/custom</code> with content:</p>
  
  <pre><code>&lt;Files "*"&gt;
    Order allow,deny
    Deny from all
  &lt;/Files&gt;
  </code></pre>
  
  <p>What webserver are you using?  Is this on a hosted environment or your own server?  The server needs to be configured to use <code>.htaccess</code> files</p>
  
  <p>For Apache, see <a href="https://httpd.apache.org/docs/current/mod/core.html#allowoverride" rel="nofollow noreferrer">https://httpd.apache.org/docs/current/mod/core.html#allowoverride</a>  </p>
  
  <p>For nginx, see other posts on this site - eg:</p>
  
  <ul>
  <li><a href="https://civicrm.stackexchange.com/questions/4042/files-in-the-data-directory-upload-customshould-not-be-downloadable-nginx">Files in the data directory (Upload | Custom)should not be downloadable. (Nginx)</a></li>
  <li><a href="https://civicrm.stackexchange.com/questions/27/is-civicrm-compatible-with-nginx">Is CiviCRM compatible with Nginx?</a></li>
  <li><a href="https://civicrm.stackexchange.com/questions/4460/security-warning-on-dashboard-pantheon-nginx">Security Warning on Dashboard (pantheon / nginx)</a></li>
  </ul>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-11-08T11:38:18.943Z
Answers.Text: I am using Nginx in AWS. How can I edit that .htaccess files. Thanks!
Answers.UserDisplayName: santiagoelie
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-11-08T11:45:56.867Z
Answers.Text: I find .htaccess from every directory, it shows that content. How can I edit and what config I need to input to prevent access? Thanks!
Answers.UserDisplayName: santiagoelie
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-11-08T13:06:28.053Z
Answers.Text: I've added links to nginx posts
Answers.UserDisplayName: Aidan
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-11-08T13:17:18.383Z
Answers.Text: Thanks Aidan! One last thing, all I need is to configure the nginx config to solved this problem, right? Also how about the CiviCRM debug log warning? Thanks
Answers.UserDisplayName: santiagoelie
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-11-08T18:30:54.653Z
Answers.Text: Yes, should just need some nginx config changes.  debug log is in the ConfigAndLog directory - ie same thing for each directory
Answers.UserDisplayName: Aidan
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-11-08T18:46:45.067Z
Answers.Text: what do you mean about debug log? inside ConfigAndLog dir? can you please easily explain to understand. Thanks so much.
Answers.UserDisplayName: santiagoelie
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-11-08T19:56:23.087Z
Answers.Text: The 3 warnings in your original post are all the same issue but referring to different directories.  With apache, those directories are protected via .htaccess files.  With nginx, you need to make a config change for the 3 directories in my answer
Answers.UserDisplayName: Aidan
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-11-08T10:42:43.410Z
Answers.LastActivityDate: 2018-11-08T13:06:09.907Z
Answers.LastEditDate: 2018-11-08T13:06:09.907Z
Answers.UserDisplayName: Aidan
Answers.Body: <p>You need to check the permissions on the hosting server for the directories in the warning. The directory permissions should be set to 0755, or it may show as 755. The files within the directories should show 0644, or 644.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-11-08T10:44:38.803Z
Answers.Text: Those file permissions still allow reads which is what the warning relates to.
Answers.UserDisplayName: Aidan
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-11-07T13:13:32.080Z
Answers.LastActivityDate: 2018-11-07T13:13:32.080Z
Answers.UserDisplayName: Tony Horrocks
Body: <p>How can I fix this error on CiviCRM. Thanks.<a href="https://i.sstatic.net/8qyWC.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/8qyWC.png" alt="enter image description here"></a></p>
  
Tags: <files>
Title: Private Files Readable
ThreadText: # Private Files Readable
  
  (Asked by: username_0 on 2018-11-07)
  
  How can I fix this error on CiviCRM. Thanks.[![enter image description here](https://i.sstatic.net/8qyWC.png)](https://i.sstatic.net/8qyWC.png)
  
  **Tags:** files
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2018-11-08. Score: 2 | Accepted answer
  
  Preventing access to those files should be taken care of by .htaccess files.
  You should have .htaccess files under files/civicrm/ConfigAndLog, files/civicrm/upload, files/civicrm/custom with content:
  
    Order allow,deny
    Deny from all
  
  
  What webserver are you using?  Is this on a hosted environment or your own server?  The server needs to be configured to use .htaccess files
  For Apache, see https://httpd.apache.org/docs/current/mod/core.html#allowoverride 
  For nginx, see other posts on this site - eg:
  
  Files in the data directory (Upload | Custom)should not be downloadable. (Nginx)
  Is CiviCRM compatible with Nginx?
  Security Warning on Dashboard (pantheon / nginx)
  
  > **Comments:**
  > **username_0**: I am using Nginx in AWS. How can I edit that .htaccess files. Thanks!  
  > **username_0**: I find .htaccess from every directory, it shows that content. How can I edit and what config I need to input to prevent access? Thanks!  
  > **username_1**: I've added links to nginx posts  
  > **username_0**: Thanks username_1! One last thing, all I need is to configure the nginx config to solved this problem, right? Also how about the CiviCRM debug log warning? Thanks  
  > **username_1**: Yes, should just need some nginx config changes.  debug log is in the ConfigAndLog directory - ie same thing for each directory  
  > **username_0**: what do you mean about debug log? inside ConfigAndLog dir? can you please easily explain to understand. Thanks so much.  
  > **username_1**: The 3 warnings in your original post are all the same issue but referring to different directories.  With apache, those directories are protected via .htaccess files.  With nginx, you need to make a config change for the 3 directories in my answer  
  
  ---
  
  ### Answer by username_2 on 2018-11-07. Score: 1
  
  You need to check the permissions on the hosting server for the directories in the warning. The directory permissions should be set to 0755, or it may show as 755. The files within the directories should show 0644, or 644.
  
  > **Comments:**
  > **username_1**: Those file permissions still allow reads which is what the warning relates to.  
  
  ---
  
  