Drupal incorrectly reporting that permissions need to be set on settings.php I've updated a site to v8.5.3.  Checking the status report I have various messages.  One says:

Not protected
    Protection disabled
   - The file sites/default/settings.php is not protected from modifications and 
    poses a security risk. You must change the file's permissions to be non- 
    writable.
   - The file sites/default/settings.local.php is not protected from 
     modifications and poses a security risk. You must change the file's 
     permissions to be non-writable.

I've checked these files and they are set to 444, there are no write permissions set.  Drupal seems to be reporting this incorrectly.

Is there anything else I need to do or am I missing anything?
They keyline here is Protection disabled.

Which means you have to check your settings.php or setting.local.php for

$settings['skip_permissions_hardening'] = TRUE;


which must be

$settings['skip_permissions_hardening'] = FALSE;


instead.

If it's not there already, add it.

Flush cache, done.