Body: <p>I have noted that CiviCRM creates .htaccess with the <code>Deny from all</code> command in stead of the <code>Require all denied</code>. This causes security issues with my new setup at a hosting site.</p>
  
  <p>Drupal has support for both:</p>
  
  <pre><code># Deny all requests from Apache 2.4+.
  &lt;IfModule mod_authz_core.c&gt;
    Require all denied
  &lt;/IfModule&gt;
  
  # Deny all requests from Apache 2.0-2.2.
  &lt;IfModule !mod_authz_core.c&gt;
    Deny from all
  &lt;/IfModule&gt;
  </code></pre>
  
  <p>When is CiviCRM going to support Apache 2.4?</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-12-10T23:05:20.170Z
Comments.Text: This is a good catch!  Are you able to submit a pull request for this improvement?
Comments.UserDisplayName: Jon G - Megaphone Tech
Tags: <security><webserver>
Title: Support for Apache 2.4
ThreadText: # Support for Apache 2.4
  
  (Asked by: username_0 on 2017-12-10)
  
  I have noted that CiviCRM creates .htaccess with the Deny from all command in stead of the Require all denied. This causes security issues with my new setup at a hosting site.
  Drupal has support for both:
  # Deny all requests from Apache 2.4+.
  
    Require all denied
  
  
  # Deny all requests from Apache 2.0-2.2.
  
    Deny from all
  
  
  When is CiviCRM going to support Apache 2.4?
  
  **Tags:** security, webserver
  
  > **Comments:**
  > **username_1**: This is a good catch!  Are you able to submit a pull request for this improvement?  
  
  ---
  
  ## 0 answers
  
  