# Security Enhancement: Blocking macOS .DS\_Store Files **URL:** \ **Category:** Elements Hosting\ **Tags:** security, elements-hosting, elementsplatform\ **Created:** [September 18, 2026, 2:58am UTC](https://forums.realmacsoftware.com/t/security-enhancement-blocking-macos-ds-store-files/57647 "2026-09-18T02:58:22Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![differentdan](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/differentdan/32/33530_2.png) [@differentdan](https://forums.realmacsoftware.com/u/differentdan)\ **Post date:** [September 18, 2026, 2:58am UTC](https://forums.realmacsoftware.com/t/security-enhancement-blocking-macos-ds-store-files/57647/1 "2026-09-18T02:58:22Z")
Hi Elements Hosters. 👋 We’ve rolled out a small security enhancement across all Elements Hosting servers. As of today, our web servers will automatically block public web access to macOS `.DS_Store` files wherever they may exist within a hosted website. If someone attempts to access one of these files through a browser, the server will now return a **403 Forbidden** response. **Before** ![DS_Store-before](https://europe1.discourse-cdn.com/flex005/uploads/realmacsoftware1/original/3X/f/2/f2084b072c3d2e885e8fb011a7d4947dbe12169c.jpeg) **After** ![DS_Store-after](https://europe1.discourse-cdn.com/flex005/uploads/realmacsoftware1/original/3X/a/1/a1079f4369de5e7b7f3aac3b6a61213619f20f9e.jpeg) #### What is a `.DS_Store` file? `.DS_Store` files are hidden metadata files automatically created by **macOS Finder**. They can contain information Finder uses to remember things such as folder display preferences and information about files or folders within a directory. They are binary files rather than normal text files, but their contents can be parsed by specialized tools. In some circumstances, this means they can unintentionally disclose filenames or directory names that Finder has recorded. There is no reason for a `.DS_Store` file to be publicly accessible on a web server, so Elements Hosting now blocks access to them globally. #### Why did we make this change? This change has been made out of an extraordinary abundance of caution and as an additional defense-in-depth measure. RapidWeaver and Elements do **not** create or upload `.DS_Store` files when exporting or publishing a website. These hidden metadata files are created by **macOS Finder** and may appear after a folder has been accessed or modified, such as when files are created, copied, or moved within that folder, or when its Finder view settings are changed. For a `.DS_Store` file to reach a hosting account, someone would generally need to: 1. Export their website to a local folder on their Mac. 2. Have macOS subsequently create a `.DS_Store` file in that folder. 3. Upload the website using a third-party FTP/SFTP application that is configured to include hidden files. Not all FTP/SFTP applications upload hidden files by default. We recently looked at a theoretical scenario where metadata within an accidentally uploaded `.DS_Store` file could potentially reveal information about otherwise difficult-to-discover files or directories. One example is the optional project file backup created by RapidWeaver/Elements after publishing. These backups are stored inside randomly generated directories with names similar to: `1A2B3C4D5-67E8-9F01-A1B22-P307123B11JC_rwbackup` These randomly generated directory names provide an extremely large number of possible combinations, making discovery through brute-force guessing practically impossible. The more realistic theoretical concern would therefore not be someone successfully guessing such a directory, but the directory name becoming known indirectly through information accidentally exposed elsewhere. Because `.DS_Store` files can contain filesystem metadata, we decided there was simply no good reason to allow them to be served publicly in the first place. #### What do you need to do? If you’re hosted with [Elements Hosting](https://elementshosting.io/), nothing. 🙂 This protection has been enabled automatically across the entire Elements Hosting platform and applies to all hosted websites. It also applies regardless of where a `.DS_Store` file appears within a website — whether it is in the site’s root directory or further down within another folder. If you host your website elsewhere and your web host uses Apache with `.htaccess` support enabled, you can usually add the following rule to the `.htaccess` file in your website’s root directory: ```auto Require all denied ``` This instructs Apache to return a **403 Forbidden** response if someone attempts to access a `.DS_Store` file through the web. If you’re unsure whether your hosting provider uses Apache or supports `.htaccess` files, check with your web host before making the change. #### Conclusion This is a small change, and the scenario it protects against requires a fairly unusual combination of circumstances, but security is often about eliminating unnecessary opportunities for information disclosure before they ever become a problem. We’ll continue looking for small improvements like this that make Elements Hosting safer while keeping everything simple and transparent for our customers. 💜