# Your web server is not applying Grav's access rules
**URL:** https://forum.yunohost.org/t/your-web-server-is-not-applying-gravs-access-rules/42894
**Category:** Support apps
**Tags:** grav, french, english
**Created:** [August 29, 2026, 1:37pm UTC](https://forum.yunohost.org/t/your-web-server-is-not-applying-gravs-access-rules/42894 "2026-08-29T13:37:46Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Dams](https://forum.yunohost.org/u/Dams)
#### Post date: [August 29, 2026, 1:37pm UTC](https://forum.yunohost.org/t/your-web-server-is-not-applying-gravs-access-rules/42894/1 "2026-08-29T13:37:46Z")
### I have searched the forum for similar issues
on
### This category is for issues regarding specific apps, _NOT_ general issues with YunoHost.
on
### This form is written in English but feel free to write in French if you’re more comfortable!
on
### What app is this about, and its version
Grav, v2.0.21
### What YunoHost version are you running
12.1.40.1
### What type of hardware are you using
Old laptop or computer
### Describe your issue
Since I updgraded to Grav 2.0.21 I get this error message
> **Your web server is not applying Grav’s access rules**
> Your web server is not applying Grav’s recommended access rules, so files in user/ can be reached directly over the web. It is worth tightening up, since some plugins do store data here.
> [How to fix this](https://learn.getgrav.org/security/user-folder-exposure)
The issue can be fixed in Ngnix config but I guess it’s better if the Yunohost package does it by default.
### Share relevant logs or error messages
Your web server is not applying Grav’s recommended access rules, so files in user/ can be reached directly over the web. It is worth tightening up, since some plugins do store data here.
---
### Author:  [@nite\_route](https://forum.yunohost.org/u/nite_route)
#### Post date: [August 30, 2026, 5:16am UTC](https://forum.yunohost.org/t/your-web-server-is-not-applying-gravs-access-rules/42894/2 "2026-08-30T05:16:33Z")
yeah grav 2 started actually checking this instead of just warning. yunohost is nginx so the apache rules in the grav tree never apply, thats why it showed up after the upgrade. you can drop a snippet in the app extra nginx conf denying /user/ (and cache/backup/logs) with 403 then reload. longer term it belongs in the grav\_ynh package so it doesnt get wiped on upgrade, worth filing on the github app repo.
---
### Author:  [@system](https://forum.yunohost.org/u/system)
#### Post date: [September 14, 2026, 5:17am UTC](https://forum.yunohost.org/t/your-web-server-is-not-applying-gravs-access-rules/42894/3 "2026-09-14T05:17:02Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.