Answers.Body: <p>I found a solution. But thanks @Demerit, you gave the start. I made the assumption that the configuration <code>.htaccess</code> is done differently for Apache 2.2. And the drupal <code>.htaccess</code> gave some inspiration. I created the following file</p>
  
  <pre><code>&lt;Files "*"&gt;
    Require all denied
  &lt;/Files&gt;
  </code></pre>
  
  <p>And that works. Because there is already a .htacess file CiviCRM does not overwrite it.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-10-29T13:30:43.933Z
Answers.LastActivityDate: 2018-10-29T13:30:43.933Z
Answers.UserDisplayName: Kainuk - CiviCooP
Answers.Body: <p>It's possible that the config for the virtual host/Directory does not allow .htaccess override for the Limit directive type, and so is ignoring the Order commands.</p>
  
  <p>See <a href="https://httpd.apache.org/docs/2.2/mod/core.html#allowoverride" rel="nofollow noreferrer">https://httpd.apache.org/docs/2.2/mod/core.html#allowoverride</a></p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-07-25T19:02:21.043Z
Answers.LastActivityDate: 2018-07-25T19:02:21.043Z
Answers.UserDisplayName: Demerit
Body: <p>On the <code>civicrm/a/#/status</code> the security message <em>The CiviCRM debug log should not be downloadable</em> is displayed. And the complaint is correct, I am able to download the log file. But CiviCRM does generate the correct <code>.htaccess</code> file in de log directory in the following format</p>
  
  <pre><code>&lt;Files "*"&gt;
    Order allow,deny
    Deny from all
  &lt;/Files&gt;
  </code></pre>
  
  <p>The used configuration is CiviCRM 5.3.1, Drupal 7.0 and Apache/2.2.15.</p>
  
  <p>The <code>.htaccess</code> file is seen by apache. I tested this by making a syntax error in the file. That is reported by the webserver.</p>
  
  <p>Does someone has a hint to get it working again.</p>
  
Tags: <security><logs>
Title: The CiviCRM debug log should not be downloadable - generated .htaccess seems ok
ThreadText: # The CiviCRM debug log should not be downloadable - generated .htaccess seems ok
  
  (Asked by: username_0 on 2018-07-25)
  
  On the civicrm/a/#/status the security message The CiviCRM debug log should not be downloadable is displayed. And the complaint is correct, I am able to download the log file. But CiviCRM does generate the correct .htaccess file in de log directory in the following format
  
    Order allow,deny
    Deny from all
  
  
  The used configuration is CiviCRM 5.3.1, Drupal 7.0 and Apache/2.2.15.
  The .htaccess file is seen by apache. I tested this by making a syntax error in the file. That is reported by the webserver.
  Does someone has a hint to get it working again.
  
  **Tags:** security, logs
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_0 on 2018-10-29. Score: 1
  
  I found a solution. But thanks @username_1, you gave the start. I made the assumption that the configuration .htaccess is done differently for Apache 2.2. And the drupal .htaccess gave some inspiration. I created the following file
  
    Require all denied
  
  
  And that works. Because there is already a .htacess file CiviCRM does not overwrite it.
  
  
  ---
  
  ### Answer by username_1 on 2018-07-25. Score: 1
  
  It's possible that the config for the virtual host/Directory does not allow .htaccess override for the Limit directive type, and so is ignoring the Order commands.
  
  See <https://httpd.apache.org/docs/2.2/mod/core.html#allowoverride>
  
  
  ---
  
  