How can I fix this error on CiviCRM. Thanks.

Preventing access to those files should be taken care of by .htaccess files.

You should have .htaccess files under files/civicrm/ConfigAndLog, files/civicrm/upload, files/civicrm/custom with content:

<Files "*">
Order allow,deny
Deny from all
</Files>


What webserver are you using? Is this on a hosted environment or your own server? The server needs to be configured to use .htaccess files

For nginx, see other posts on this site - eg:

• I am using Nginx in AWS. How can I edit that .htaccess files. Thanks! – santiagoelie Nov 8 '18 at 11:38
• I find .htaccess from every directory, it shows that content. How can I edit and what config I need to input to prevent access? Thanks! – santiagoelie Nov 8 '18 at 11:45
• I've added links to nginx posts – Aidan Nov 8 '18 at 13:06
• Thanks Aidan! One last thing, all I need is to configure the nginx config to solved this problem, right? Also how about the CiviCRM debug log warning? Thanks – santiagoelie Nov 8 '18 at 13:17
• Yes, should just need some nginx config changes. debug log is in the ConfigAndLog directory - ie same thing for each directory – Aidan Nov 8 '18 at 18:30

You need to check the permissions on the hosting server for the directories in the warning. The directory permissions should be set to 0755, or it may show as 755. The files within the directories should show 0644, or 644.

• Those file permissions still allow reads which is what the warning relates to. – Aidan Nov 8 '18 at 10:44