Install.php available after xcopy deployment
What the installer checks for, is whether or not the settings file has database information for the site.

While this sounds simple in theory, and shouldn't lead to install.php being executed, there are many components involved.


There's DNS, which may or may not respond to various sub-domains.
There's the webserver configuration, which may or may not serve sub-domains, and may or may not re-write them before they hit Drupal.
Drupal, since 7, supports a sites.php file which can map domains to sites/ directories.
Finally, there's the sites directory itself, where Drupal can find a settings.php file, check for a valid $db_url, and decide whether or not to allow installation.


Due to the many components, and the technical complexity of setting them all up right, it's very easy to end up in a situation where install.php decides to allow installation. This should generally not be a problem, as anonymous users should not be able to create new databases, but it looks quite wrong regardless.

While removing install.php is a solution, it's technically hacking core, and makes future deployments needlessly complicated.

I normally do two things to counteract this.

The first thing is to run the site from a directory named after the domain, such as sites/example.com/ and make sites/default a link to the main site. This way, any unexpected domains being requested by Drupal will be served by the main domain.

Second, I always just block access to install.php completely on any production systems with this vhost file:

# ssh -L 8080:127.0.0.1:80 example.com
&lt;Location /install.php&gt;
  Deny from all
  Allow from 127.0.0.1
&lt;/Location&gt; 

&lt;Location /update.php&gt;
  Deny from all
  Allow from 127.0.0.1
&lt;/Location&gt;


This ensures apache blocks access to both install and update. The comment at the top is a reminder for how I can open an ssh tunnel to the server so my traffic looks like it's coming from 127.0.0.1, thus allowing developers access to run update.php.

Something similar in IIS below. Note that I have not tested this. Someone with ISS experience, please update or comment so I can improve this part.

&lt;location path="install.php"&gt;
    &lt;system.webServer&gt;
        &lt;security&gt;
            &lt;authorization&gt;
                &lt;remove users="*" roles="" verbs="" /&gt;
                &lt;add accessType="Allow" roles="Administrators" /&gt;
            &lt;/authorization&gt;
        &lt;/security&gt;
    &lt;/system.webServer&gt;
&lt;/location&gt;