Creating a Drupal 8 Private File System

Creating a Drupal 8 Private File System

An OSTraining member asked how they could set up a Drupal 8 private file system.

In Drupal 7 you could do this from the configuration at Administrator > Configuration > Media > File System.

In Drupal 8, we have to set the private path manually.

  • Create a directory for the private files to be saved in:

Create a directory for the private files

You may want to use a name that won’t be considered important. For this tutorial, I have simply called it ‘private’.

  • Go to your sites/default/settings.php. On line 533 you should find the setting we need to edit hashed out:

Settings.php file in Drupal

  • Remove the hash and enter the path for your private directly. In my case, this is ‘sites/default/files/private’:


  • Save and close settings.php file
  • Flush the cache, which you can find in Administration > Configuration > Development > Performance:

Flush the Drupal cache

  • Go to the File System and see if Drupal is detecting the private file storage: Administrator > Configuration > Media > File system

Is private file storage working in Drupal

  • Select the private directory and save this configuration.

Drupal should automatically include a new .htaccess file inside the folder.

Now you have a private directory to store your files in.


0 0 votes
Article Rating
Notify of

Newest Most Voted
Inline Feedbacks
View all comments
6 years ago

I didn’t see you create the folder ‘private’ inside a directory called ‘D8’. So how did you get this path: D8/private? It looks like you created a folder called ‘private’ inside sites/default/… Other instructions indicate the private directory should be at the root (on the same level as public_html).

6 years ago

I don’t understand why you have the private files using a path of ‘D8/private’ and then you use ‘sites/default/files/private’. I thought the folder called ‘private’ was supposed to be at the root level, i.e. on the same level as public_html … ??? Can you show the file structure so that I can understand what you are referencing? This seems like something that should be very simple.

6 years ago

I have the same question as below. Where did D8\private come from? In the settings file it says the private folder should be outside the D8 installation directory and yet you put the private folder in the files directory?

6 years ago
Reply to  John

I understand what you have done Mr daniel and thanks for your contribution but the issues still remain with status report :1.Writable (private download method)
The directory /sites/default/files/private does not exist. You may need to set the correct directory at the file system settings page or change the current directory’s permissions so that it is writable.

Private files directory
Not fully protected
See for information about the recommended .htaccess file which should be added to the directory to help protect against arbitrary code execution.

6 years ago

This post could do to be updated to reflect how to use private files with a directory outside of the web root (and to correct the confusion mentioned in the other comments!)

5 years ago

Doesn’t the file path need to be absolute as in /var/www/mydrupal/sites/default/files/private? At least that’s what the current default.settings.php is telling us.

4 years ago

Setting the private files path to ‘sites/default/files/private’ doesn’t seem to work in Drupal >8.5.  I had to use an absolute or relative file path pattern, ‘/sites/default/files/private’ or ‘./sites/default/files/private’ from the drupal root for this to work.

Guilherme Puentes
Guilherme Puentes
4 years ago

Webform se faz necessário. Eu tinha esquecido como era.  (D_v8.90 – 18/06/20)

Funcionou de primeira. 
pasta=file [i]777[/i]
arquivo=settings 777 
criar a pasta ( [b]private [/b]) 755
 – – .htaccess 444

volte permissões por segurança 
pasta=file [u]555[/u]
arquivo=settings [u]444[/u]

Would love your thoughts, please comment.x