I am running a drupal site on nginx and I have a civicrm set-up on this site. Whenever I login and goto civicrm dashboard, I am getting this warnings. I have tried searching solution for this, not able to fix it.

Files in the data directory (/home/drupal7/sites/example.org/files/civicrm/custom/) should not be downloadable.

Read more about this warning

Files in the data directory (/home/drupal7/sites/example.org/files/civicrm/upload/) should not be downloadable.

Read more about this warning

I have tried this on my nginx configuration file.

    root /home/drupal7;

    location ~ /sites/example.org/files/civicrm/(custom|upload) {
        deny all;
        return 404;

1 Answer 1


Your proposed solution in your nginx config looks about right; here's a tested & working example:

location ~* ^/sites/(.*)/files/civicrm/(ConfigAndLog|templates_c|upload|custom) {
    deny all;

Here are some things you could check.

  1. Have you reloaded nginx since making the config change?

  2. Pick a file in files/civicrm/custom/ and try to access it in a browser.

    • If you can, the nginx config needs fixing.
    • If you can't, the warning is spurious; it would be good to investigate why. Check your nginx access logs for the test requests that Civi makes to check access.
  3. Is another location block in your nginx config taking precedence over this one? You can check this by temporarily enabling debug-level logging for the relevant virtual host, e.g.

    error_log /path/to/log debug;

(Note that nginx needs to have been built with --with-debug .) This will produce very verbose logging, so only enable it briefly while testing: enable debug, access a file under files/civicrm/custom/ , disable debug, then look through your error log for the request. From this, you should be able to see which location block matched the request.

You should also deny access to ConfigAndLog/ and templates_c/ as in the config above.

See checkUploadsAreNotAccessible.

  • thanks. it's working. I tested it as well. One gotcha here though. This config should be on top of the other. Since I had location directive set for *.jpg files to expire max and I was able to browse jpg files under upload directory. now that I have set this on top (below root) this is working fine now. :) Thanks much.
    – shrish
    Jul 20, 2015 at 11:57
  • Is there a way to correct this issue without configuring nginx? I am hosting on pantheon and don't have access to nginx configs
    – Yossi
    Aug 5, 2015 at 23:15
  • @YossiCrm Not that I know of. Nginx doesn't use .htaccess files, which are used to configure Civi's per-directory access restrictions under Apache.
    – davejenx
    Aug 6, 2015 at 9:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.