Magento 2:Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact your hosting provider

Question

I'm struggling trying to solve this very annoying problem on my Magento 2.3.3 store. Today I forced the SSL on the website (I did it that by enabling the https on the unsecure URL). After 10-15 mins, while I was editing some coupon codes, I got this notification on my backend:

Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact your hosting provider.

I tried EVERYTHING. The /app folder has the .htaccess file and has this rule (everybody was suggesting this as a fix).

<IfVersion < 2.4>
    order allow,deny
    deny from all
</IfVersion>
<IfVersion >= 2.4>
    Require all denied
</IfVersion>

All my folders seem to have 755 and all the files 644 permission.

PLEASE NOTE: This error occurs when the /app folder is visible to everybody. The weird thing is that if I try to navigate on that folder, or app/etc/config.php, it gives me error 404, so it looks like my files are safe.

Why I'm getting this error?

PLEASE, HELP !!!

Answer 1

Please put the root folder to pub and refresh the cache. It will resolve your issue.

Thanks

Answer 2

Finally! After days of searching I found the solution and sadly it was not written nowhere.

The problem was the base URL. Apparently Magento 2 doesn't like https as base URL ( I changed it to always redirect to https). I had to put http again, flush the cache and after few mins, the warning disappeared. The warning will not disappear immediately, because the server needs to process the request (I think).

So, if you want to force to https, instead of doing it in that way, just add these lines in your .httaccess (in the root).

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Hope this will save days and days of searching to other people!

Answer 3

The Magento security checker just does a simple cURL POST request to app/etc/config.php (see: Source Code). If the response to this initial request is a 200, then it shows the message; otherwise, it will not show the message.

I have all of my servers configured with a base URL of https:// and then within the server configuration I redirect non-SSL to SSL. The only time I've seen this show up is with a stage / test server where we have a password-gate script up. So any unauthenticated request resulted in a password page. After modifying the script to return a 404 status for the security check, the warning messages went away.

This should have nothing to do with file permissions on the server itself; although, securing those wouldn't hurt either. The issue is that somehow Magento is receiving a 200 OK response when making the following request:

POST /app/etc/config.php
Host: <your_base_hostname>

This command via cURL would be:

curl --connect-timeout 2 \
     --proto =http,https,ftp,ftps \
     --location
     --max-redirs 2 \
     -w "\nHTTP CODE: %{http_code}" \
     -d "" \
     http://magento.local/app/etc/config.php

You can use the above to see if a 404 is returned via the redirect. You can remove the --location flag to stop following redirects to see the initial response.

I don't run Apache anymore (we've moved on to Nginx), so I can't help you with the configuration; however, I would suspect either your .htaccess isn't being respected (allow-override isn't enabled or .htaccess isn't readable by www-data) or there is something else causing a successful response in some circumstances (e.g. from the local server versus from external).