Hi Elements Hosters. 
We’ve rolled out a small security enhancement across all Elements Hosting servers.
As of today, our web servers will automatically block public web access to macOS .DS_Store files wherever they may exist within a hosted website.
If someone attempts to access one of these files through a browser, the server will now return a 403 Forbidden response.
Before
After
What is a .DS_Store file?
.DS_Store files are hidden metadata files automatically created by macOS Finder. They can contain information Finder uses to remember things such as folder display preferences and information about files or folders within a directory.
They are binary files rather than normal text files, but their contents can be parsed by specialized tools. In some circumstances, this means they can unintentionally disclose filenames or directory names that Finder has recorded.
There is no reason for a .DS_Store file to be publicly accessible on a web server, so Elements Hosting now blocks access to them globally.
Why did we make this change?
This change has been made out of an extraordinary abundance of caution and as an additional defense-in-depth measure.
RapidWeaver and Elements do not create or upload .DS_Store files when exporting or publishing a website. These hidden metadata files are created by macOS Finder and may appear after a folder has been accessed or modified, such as when files are created, copied, or moved within that folder, or when its Finder view settings are changed.
For a .DS_Store file to reach a hosting account, someone would generally need to:
-
Export their website to a local folder on their Mac.
-
Have macOS subsequently create a
.DS_Storefile in that folder. -
Upload the website using a third-party FTP/SFTP application that is configured to include hidden files.
Not all FTP/SFTP applications upload hidden files by default.
We recently looked at a theoretical scenario where metadata within an accidentally uploaded .DS_Store file could potentially reveal information about otherwise difficult-to-discover files or directories.
One example is the optional project file backup created by RapidWeaver/Elements after publishing. These backups are stored inside randomly generated directories with names similar to:
1A2B3C4D5-67E8-9F01-A1B22-P307123B11JC_rwbackup
These randomly generated directory names provide an extremely large number of possible combinations, making discovery through brute-force guessing practically impossible.
The more realistic theoretical concern would therefore not be someone successfully guessing such a directory, but the directory name becoming known indirectly through information accidentally exposed elsewhere.
Because .DS_Store files can contain filesystem metadata, we decided there was simply no good reason to allow them to be served publicly in the first place.
What do you need to do?
If you’re hosted with Elements Hosting, nothing. 
This protection has been enabled automatically across the entire Elements Hosting platform and applies to all hosted websites.
It also applies regardless of where a .DS_Store file appears within a website — whether it is in the site’s root directory or further down within another folder.
If you host your website elsewhere and your web host uses Apache with .htaccess support enabled, you can usually add the following rule to the .htaccess file in your website’s root directory:
<Files ".DS_Store">
Require all denied
</Files>
This instructs Apache to return a 403 Forbidden response if someone attempts to access a .DS_Store file through the web.
If you’re unsure whether your hosting provider uses Apache or supports .htaccess files, check with your web host before making the change.
Conclusion
This is a small change, and the scenario it protects against requires a fairly unusual combination of circumstances, but security is often about eliminating unnecessary opportunities for information disclosure before they ever become a problem.
We’ll continue looking for small improvements like this that make Elements Hosting safer while keeping everything simple and transparent for our customers. 