Answers.Body: <p>So as he why you get security warnings: because civi has found your configuration insecure, ie. you have files that shouldn't be accessible on the web but are.</p>
  
  <p>As how you fix it (and get rid of the warnings), it depends on the web server you use and how it's configured.</p>
  
  <p>The .htaccess rules only work for apache, and only if it's configured to read them. If you use nginx or another webserver, you will need to implement the rules denying access to these forbidden folders differently.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-10-28T13:40:53.990Z
Answers.Text: The problem was with the shared server, spent a frustrating few days convincing them that was the case - and not Civi.  Eventually they fixed the problem by moving my 5 clients to a different server, while they continued to work on a fix - which was apparently an Apache problem.
  Plaudits to Civi team for putting those checks in the code!
Answers.UserDisplayName: Andy Clark
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-10-24T01:04:15.457Z
Answers.LastActivityDate: 2017-10-24T01:04:15.457Z
Answers.UserDisplayName: Xavier
Body: <p>User just got 3 security warnings about access to sites/default/files/civicrm/custom &amp; sites/default/files/civicrm/upload &amp; sites/default/files/civicrm/ConfigAndLog.  </p>
  
  <p>I changed the access of all to 555 but still get the message for the last one (ConfigAndLog). In this folder there is an .htaccess file - below.
  Release is 4.6.29, Drupal 7.  I'm puzzled why this has happened today - 4.6.29 has been there for months. So- </p>
  
  <ol>
  <li>Why have these messages popped up now? I guess this is something timed to appear today as I also get it on a 4.7 system </li>
  <li>How do I fix the ConfigAndLog message which is still appearing?</li>
  </ol>
  
  <p><a href="https://i.sstatic.net/M3EsD.jpg" rel="nofollow noreferrer"><img src="https://i.sstatic.net/M3EsD.jpg" alt="enter image description here"></a></p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-10-23T16:11:47.297Z
Comments.Text: Can you say what your web server software is (Apache, nginx, etc.) and what version?
Comments.UserDisplayName: Jon G - Megaphone Tech
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-10-23T16:13:39.817Z
Comments.Text: Also, 555 means that the web server can't write new files to those directories.
Comments.UserDisplayName: Jon G - Megaphone Tech
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-10-23T17:38:06.730Z
Comments.Text: Apache 2.4.25 and I reverted the 555 to 755 and now have the messages again. Also happening on a 4.7 system. Other users must be getting the same messages unless it's some local host system changes.
Comments.UserDisplayName: Andy Clark
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-10-23T17:41:00.220Z
Comments.Text: Also, I notice that these messages can't be disabled in the 'Misc' settings & regular users get them as well as administrators, which is likely to be alarming for them.
Comments.UserDisplayName: Andy Clark
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-10-23T18:05:17.943Z
Comments.Text: My guess is that your Apache vhost configuration changed to ignore .htaccess.  Can you confirm that your files are, in fact, downloadable?  If you're not sure how to check, contact me at @junglebird on chat.civicrm.org, checking requires access to file paths that ideally you're not posting here.
Comments.UserDisplayName: Jon G - Megaphone Tech
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-10-23T18:21:40.533Z
Comments.Text: Yes, I was able to access a file in the upload folder from the website, so they are downloadable.  So I will talk to the hosting company.  +1 to Civi code for highlighting this problem!
Comments.UserDisplayName: Andy Clark
Tags: <error><4.6><security>
Title: Why do I get security warning & how to remove?
ThreadText: # Why do I get security warning & how to remove?
  
  (Asked by: username_0 on 2017-10-23)
  
  User just got 3 security warnings about access to sites/default/files/civicrm/custom & sites/default/files/civicrm/upload & sites/default/files/civicrm/ConfigAndLog.
  
  I changed the access of all to 555 but still get the message for the last one (ConfigAndLog). In this folder there is an .htaccess file - below.
  Release is 4.6.29, Drupal 7. I'm puzzled why this has happened today - 4.6.29 has been there for months. So-
  
  1. Why have these messages popped up now? I guess this is something timed to appear today as I also get it on a 4.7 system
  2. How do I fix the ConfigAndLog message which is still appearing?
  
  [![enter image description here](https://i.sstatic.net/M3EsD.jpg)](https://i.sstatic.net/M3EsD.jpg)
  
  **Tags:** error, 4.6, security
  
  > **Comments:**
  > **username_1**: Can you say what your web server software is (Apache, nginx, etc.) and what version?  
  > **username_1**: Also, 555 means that the web server can't write new files to those directories.  
  > **username_0**: Apache 2.4.25 and I reverted the 555 to 755 and now have the messages again. Also happening on a 4.7 system. Other users must be getting the same messages unless it's some local host system changes.  
  > **username_0**: Also, I notice that these messages can't be disabled in the 'Misc' settings & regular users get them as well as administrators, which is likely to be alarming for them.  
  > **username_1**: My guess is that your Apache vhost configuration changed to ignore .htaccess.  Can you confirm that your files are, in fact, downloadable?  If you're not sure how to check, contact me at @junglebird on chat.civicrm.org, checking requires access to file paths that ideally you're not posting here.  
  > **username_0**: Yes, I was able to access a file in the upload folder from the website, so they are downloadable.  So I will talk to the hosting company.  +1 to Civi code for highlighting this problem!  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2017-10-24. Score: 1
  
  So as he why you get security warnings: because civi has found your configuration insecure, ie. you have files that shouldn't be accessible on the web but are.
  
  As how you fix it (and get rid of the warnings), it depends on the web server you use and how it's configured.
  
  The .htaccess rules only work for apache, and only if it's configured to read them. If you use nginx or another webserver, you will need to implement the rules denying access to these forbidden folders differently.
  
  > **Comments:**
  > **username_0**: The problem was with the shared server, spent a frustrating few days convincing them that was the case - and not Civi.  Eventually they fixed the problem by moving my 5 clients to a different server, while they continued to work on a fix - which was apparently an Apache problem. Plaudits to Civi team for putting those checks in the code!  
  
  ---
  
  