Prevent Apache from displaying text files within a web browser
Warning: This post is over a year old. I don't always update old posts with new information, so some of this information may be out of date.
When you download Drupal, there are several text files that are placed in the root of your installation. You don't want or need these to be visible to anyone attempting to view them in a browser - especially CHANGELOG.txt as that includes the exact version of Drupal you are running and could therefore have security implications.
Rather than delete these files or change the file permissions manually for each file, I can add the following lines into my VirtualHost configuration.
<Files ~ "\.txt$"> Order deny,allow Deny from all </Files>
This prevents any files with a .txt extension from being accessed and rendered in a web browser.
About the Author
Oliver Davies is a Full Stack Web Developer and System Administrator based in the UK. He is a Senior Software Engineer at Inviqa and a part-time freelancer specialising in Drupal, Symfony and Laravel development and Linux systems administration.