D8 doesn't create .htaccess for private file system path Following this guide: https://www.drupal.org/documentation/modules/file it says 


  "When you specify the private directory in
  admin/config/media/file-system it will automatically create the
  sub-directory &amp; create a simple .htaccess file with Deny from all."


When you edit your settings.php and add the $settings['file_private_path'] = 'sites/default/files/private' after drush rc it doesn't create the .htaccess file in my sites/default/files/private and I do not know how the correct .htaccess should look so I could add it manually?

,
This is a better .htaccess to use:

# Turn off all options we don't need.
Options -Indexes -ExecCGI -Includes -MultiViews

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
&lt;Files *&gt;
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
&lt;/Files&gt;

# If we know how to do it safely, disable the PHP engine entirely.
&lt;IfModule mod_php5.c&gt;
  php_flag engine off
&lt;/IfModule&gt;
&lt;IfModule mod_php7.c&gt;
  php_flag engine off
&lt;/IfModule&gt;


This .htaccess is the one that should have been placed in your private files directory by Drupal 8 (or 9) core. (Perhaps permissions on the private directory prevented Drupal from creating the file.)

The accepted answer above is adequate to quiet the warning from Drupal status report, but does not actually prevent the remote script execution exploit addressed in the original core security advisory from 2013.