On the civicrm/a/#/status the security message The CiviCRM debug log should not be downloadable is displayed. And the complaint is correct, I am able to download the log file. But CiviCRM does generate the correct .htaccess file in de log directory in the following format

<Files "*">
  Order allow,deny
  Deny from all

The used configuration is CiviCRM 5.3.1, Drupal 7.0 and Apache/2.2.15.

The .htaccess file is seen by apache. I tested this by making a syntax error in the file. That is reported by the webserver.

Does someone has a hint to get it working again.

2 Answers 2


It's possible that the config for the virtual host/Directory does not allow .htaccess override for the Limit directive type, and so is ignoring the Order commands.

See https://httpd.apache.org/docs/2.2/mod/core.html#allowoverride


I found a solution. But thanks @Demerit, you gave the start. I made the assumption that the configuration .htaccess is done differently for Apache 2.2. And the drupal .htaccess gave some inspiration. I created the following file

<Files "*">
  Require all denied

And that works. Because there is already a .htacess file CiviCRM does not overwrite it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.