My Magento 2 development environment has started poking me with the following error message

Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact your hosting provider

Has anyone tracked down

  1. What security checks are happening?
  2. Where in the core code these checks happen?
  • can u please tell me which version of 2,you have use
    – Amit Bera
    Feb 12, 2016 at 5:16
  • @AmitBera With individual packages being composer repositories I'm not really sure how to check that Feb 12, 2016 at 5:17
  • 1
    @AlanStorm, this message came from Magento\AdminNotification\Model\System\Message\Security class. which situation you got this message?
    – Bojjaiah
    Feb 12, 2016 at 5:35
  • @magentotwo When I logged into the backend Feb 12, 2016 at 7:29

12 Answers 12


This check says that anyone can access to app/etc/* files. For example the app/etc/env.php file that stores credentials to DB, crypt key, and other resources.

The better solution is to configure your pub folder as the web root instead of the default installation directory, usually magento2, as specified in most install docs. This will improve overall security and fix you problem. Be sure to edit your other Apache/Nginx location definitions as well. For Nginx, the $MAGE_ROOT directive should be /var/www/example.com/magento2/pub, and so should your root directive. Be sure to flush your cache after making the change as well, otherwise images and css files will be broken (System -> Tools -> Cache Management -> Flush Magento Cache).

\Magento\AdminNotification\Model\System\Message\Security is responsible for this functionality. See the _isFileAccessible method.

It will surely risk Magento store.


If you are using Apache, make sure that the .htaccess file that is included with magento in the /app/ folder is present on your web server, and that Apache is configured to use .htaccess files to override settings per folder, but this should be enabled by default.

The content of this file is supposed to be:

<IfVersion < 2.4>
    order allow,deny
    deny from all
<IfVersion >= 2.4>
    Require all denied

It's a system message and this message came from getText() method, class Magento\AdminNotification\Model\System\Message\Security.

When we open the Admin panel the controller checks the all notifications and it's related security.

you can debug from execute() method in Magento\AdminNotification\Controller\Adminhtml\System\Message\ListAction.php.

  • Useful information, but not what I asked. Some code in Magento clearly ran some systems tests and added that message. I want to know where those systems tests are. Feb 12, 2016 at 7:29

MAGENTO 2 Centos 7 Server

To fix message "Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact your hosting provider".

1) ### shh- Run the following command from your root account. ###

chown -R accountuser:accountusergroup /path-to-root-folderl/

2) ### ssh - Run the following command from the domain account user(not your web server account such as apache etc). ###

find . -type d -exec chmod 770 {} \; & find . -type f -exec chmod 660 {} \; && chmod u+x bin/magento

chmod -R g+w /path-to-root-folderl/{pub,var} chmod -R g+w /path-to-root-folderl/{app/etc,vendor} chmod -R g+s pub/static pub/media . find var/generation -type d -exec chmod g+s {} \; find var/session -type d -exec chmod g+s {} \;

3) ### ssh - Run the following command from your root account. ###

chown -R domain_account_user:webservergroup /path-to-root-folderl/var chown -R domain_account_user:webservergroup /path-to-root-folder/app/etc chown -R domain_account_user:webservergroup /path-to-root-folderl/pub chown -R webserverUSER:webservergroup /path-to-root-folder/var/session

This will fix this error and many other error. Note: disable SUPHP when using magento 2, you will save yourself a lot of headache. Currently I'm running mod_mpm_event with ea-apache24-mod_cgid and PHP 7 and ea-php70-php-fpm.

I had my magento 2 running with just mod_mpm_event with ea-apache24-mod_cgid and PHP 7 before I added PHP-FPM.

If you are running cpanel/ apache and you don't want to use easyapache to move to mod_mpm_event + ea-apache24-mod_cgid you can use shell from ssh . Run the command bellow from ssh . yum shell remove ea-apache24-mod_mpm_worker remove ea-apache24-mod_cgi install ea-apache24-mod_mpm_event install ea-apache24-mod_cgid run quit

  • that is only going to work on some hosting environments.. could be really bad idea on others
    – Andy
    Jun 8, 2017 at 18:39

In my case the problem was caused by the fact that the default store view was disabled. While the security check was made, the Magento\AdminNotification\Model\System\Message\Security class tried to download the app/etc/config.php file, an exception was thrown (Fatal error: Uncaught Magento\Framework\Exception\NoSuchEntityException: Default store is inactive), which transformed the response code to 200 (normally it should result 404). So the system thought that the file is accessible, which would mean a security issue.

Just enable the default store view to fix this.


One easy solution is, if you are not using nginx, than rename nginx.conf file to 'nginx.conf.sample' in root directory of your magento installation. This worked for me, and the warning message disappear in Magento Admin.


You need to do few things

  1. Change your site URL from HTTP to HTTPS from admin
  2. Change app/etc/config.php file permission to 660

If not showing yet, clear the cache with

php bin/magento c:c && php bin/magento c:f
  1. Now change the append below code to the app/etc/env.php

    'directories' => [ 'document_root_is_pub' => true ]

  2. Now switch the mode to production

    bin/magento deploy:mode:set production

    bin/magento cache:flush

  3. Now switch back to developer mode

    bin/magento deploy:mode:set developer

    bin/magento cache:flush

Now check your store front-end and make sure it is working.


It's a directory and files permission problem I think. Please give proper permissions like 0755 to directories 0644 to files, if it doesn't solve the issue please check the .htaccess file also.

  • useful information, but not the information I asked for. I want to know where in the Magento core codebase these checks happen. Feb 12, 2016 at 5:07

These tests are present inside the class Magento\AdminNotification\Model\System\Message\Security and that notifictaion text comes from function getText() . I think magento checks the accessibilty of app/etc/* files and based on that shows the warning in admin panel.


I got the message from the fact that I did not yet set up HTTP to HTTPS redirect.


server {
    listen      80;
    server_name example.com;
    #Rewrite all nonssl requests to ssl.
    return 301 https://$host$request_uri;


<VirtualHost *:80>
ServerName example.com
Redirect permanent / https://example.com/

see this for the http check. If http returns a 200 status code you'll get this message.


Magento ver. 2.3.5-p1 none of the above works for me.

Create a .htaccess file inside app/etc/ folder and add the following code:

Order deny,allow
Deny from all
RewriteRule ^(.*)config.php$ - [F,L]

As far as Magento 2.3.5-p1
This is because there is 200 response from posting to the url UNSECURE_BASE_URL/app/etc/config.php

curl -IX POST https://example.com/app/etc/config.php


  • Running your site from the recommend pub directory should resolve this issue.
  • The fail is not cached, as soon as it's resolved the message will go (no need to flush cache)


In addition to the above, we also got a false positive for this check when using a WAF (Stackpath). The request was triggering Stackpaths validation rules, Stackpath was returning a "I am not a robot" page for the user to validate themselves. The validation page was returned with a 200 status code, causing it to appear as though the url was available. To get around this, we added the servers IP to the WAF whitelist, which allowed the server to always get the true response (a 404).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.