I have a Magneto 2.2.3 instance and when we check for security scan it is showing below error:

We have determined that your Magento installation's configuration file(s) are publicly accessible over HTTP


How can I resolve this?

Thanks in advance.

  • did you solved it? – Piyush Aug 26 '19 at 13:13
  • Please check my answer @Piyush – Utsav Gupta Aug 27 '19 at 11:03

I added the below code into my .htaccess file. You can check with .htaccess file in the root path or in the Pub folder.

# Deny access to files with extensions .ini, .psd, .log, .sh
<FilesMatch "\.(ini|psd|log|sh)$">
    Order allow,deny
    Deny from all

It helps me. Hope this will help others. :)


Chances are your magento install isn't using this file. So get file access and in your web root and just rename the file. If your site still works you are good.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.