Are there two identical .htaccess files in a Drupal installation? I run a Drupal Commons site and I'd like to set it up on a new server. When I set this particular site up, I need to replace Drupal's base .htaccess file so that it runs in my server environment.

However, this answer states that the .htaccess is present in two places:


  The .htaccess files (which are present in at least two places) should have the permission 644.


Is this true? If so, where is the second one? Is it the one in sites/default?
There are actually 1+n .htaccess files in any given Drupal directory, where n is the number of working sites:


In the Drupal root
One for each site's files directory


The contents of the files directory .htaccess file is the following:

SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
Options None
Options +FollowSymLinks


This was done as part of a security update to Drupal 4.6.x and 4.7.x, and has been there ever since. The relevant security advisory, SA-2006-006, explains why:


  Certain -- alas, typical -- configurations of Apache allows execution of carefully named arbitrary scripts in the files directory. Drupal now will attempt to automatically create a .htaccess file in your "files" directory to protect you. This line references SA_2006_006 to lead Apache administrators to this announcement.


Thus it's not advised that you replace or remove that file.