While getting my fingers dirty with Magento2 and tracing the webservers error log (using Apache2 on a virtualhost setup on my development box) I see sporadic reports on illegal access to one of the config files: app/etc/config.php:

[Mon Dec 21 09:14:31.603958 2015] [access_compat:error] [pid 15805] [client] AH01797: client denied by server configuration: /home/user/workspace/customer/customer-magento2-shop/shop/www/app/etc/config.php

The according request from access log is: - - [21/Dec/2015:09:14:31 +0100] "POST /app/etc/config.php HTTP/1.1" 403 496 "-" "-"

I don't have a problem with the error message itself, access to that file should be blocked.

However I ask myself what is triggering these requests and why?

I assume that the HTTP request is done by the shop itself, maybe some kind of check. One indication of that could be the fact that no referrer (sic!) and no user-agent is provided with the request - so not from the standard browser.

1 Answer 1


That call is triggered by \Magento\AdminNotification\Model\System\Message\Security at method _isFileAccessible that checks if config.php file is externally accessible and, if it is, displays a warning in the admin area.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.