diff --git a/.htaccess b/.htaccess
index 7db5d3e..f390631 100644
--- a/.htaccess
+++ b/.htaccess
@@ -138,7 +138,7 @@ DirectoryIndex index.php index.html index.htm
   # custom modules or to run another PHP application in the same directory.
   RewriteCond %{REQUEST_URI} !/core/modules/statistics/statistics.php$
   # Deny access to any other PHP files that do not match the rules above.
-  RewriteRule "^.+/.*\.php$" - [F]
+  RewriteRule "^(.+/.*|autoload)\.php$" - [F]
 
   # Rules to correctly serve gzip compressed CSS and JS files.
   # Requires both mod_rewrite and mod_headers to be enabled.
diff --git a/autoload.php b/autoload.php
new file mode 100644
index 0000000..2b24d4c
--- /dev/null
+++ b/autoload.php
@@ -0,0 +1,11 @@
+<?php
+
+/**
+ * @file
+ * Includes the autoloader created by Composer.
+ *
+ * This file should be edited to change the autoloader if you are managing a
+ * project's dependencies using Composer.
+ */
+
+return require_once __DIR__ . '/core/vendor/autoload.php';
diff --git a/core/authorize.php b/core/authorize.php
index d033b7e..ec2e789 100644
--- a/core/authorize.php
+++ b/core/authorize.php
@@ -30,7 +30,7 @@
 // Change the directory to the Drupal root.
 chdir('..');
 
-$autoloader = require_once __DIR__ . '/vendor/autoload.php';
+$autoloader = require_once 'autoload.php';
 
 /**
  * Global flag to identify update.php and authorize.php runs.
diff --git a/core/install.php b/core/install.php
index 3493d4a..08c06e7 100644
--- a/core/install.php
+++ b/core/install.php
@@ -27,6 +27,6 @@
 }
 
 // Start the installer.
-$class_loader = require_once __DIR__ . '/vendor/autoload.php';
+$class_loader = require_once 'autoload.php';
 require_once __DIR__ . '/includes/install.core.inc';
 install_drupal($class_loader);
diff --git a/core/modules/statistics/statistics.php b/core/modules/statistics/statistics.php
index 4d20046..fe1b9fd 100644
--- a/core/modules/statistics/statistics.php
+++ b/core/modules/statistics/statistics.php
@@ -10,7 +10,7 @@
 
 chdir('../../..');
 
-$autoloader = require_once dirname(dirname(__DIR__)) . '/vendor/autoload.php';
+$autoloader = require_once 'autoload.php';
 
 $kernel = DrupalKernel::createFromRequest(Request::createFromGlobals(), $autoloader, 'prod');
 $kernel->boot();
diff --git a/core/modules/system/tests/http.php b/core/modules/system/tests/http.php
index 8c7d556..dfb0366 100644
--- a/core/modules/system/tests/http.php
+++ b/core/modules/system/tests/http.php
@@ -10,7 +10,7 @@
 
 chdir('../../../..');
 
-$autoloader = require_once './core/vendor/autoload.php';
+$autoloader = require_once 'autoload.php';
 
 // Set a global variable to indicate a mock HTTP request.
 $is_http_mock = !empty($_SERVER['HTTPS']);
diff --git a/core/modules/system/tests/https.php b/core/modules/system/tests/https.php
index 702184d..038b4e6 100644
--- a/core/modules/system/tests/https.php
+++ b/core/modules/system/tests/https.php
@@ -13,7 +13,7 @@
 
 chdir('../../../..');
 
-$autoloader = require_once './core/vendor/autoload.php';
+$autoloader = require_once 'autoload.php';
 
 // Set a global variable to indicate a mock HTTPS request.
 $is_https_mock = empty($_SERVER['HTTPS']);
diff --git a/core/rebuild.php b/core/rebuild.php
index 7ca8af7..24474d0 100644
--- a/core/rebuild.php
+++ b/core/rebuild.php
@@ -20,7 +20,7 @@
 // Change the directory to the Drupal root.
 chdir('..');
 
-$autoloader = require_once __DIR__ . '/vendor/autoload.php';
+$autoloader = require_once 'autoload.php';
 require_once __DIR__ . '/includes/utility.inc';
 
 $request = Request::createFromGlobals();
diff --git a/core/scripts/run-tests.sh b/core/scripts/run-tests.sh
index 4e35b28..d087e63 100644
--- a/core/scripts/run-tests.sh
+++ b/core/scripts/run-tests.sh
@@ -11,7 +11,7 @@
 use Drupal\Core\Test\TestRunnerKernel;
 use Symfony\Component\HttpFoundation\Request;
 
-$autoloader = require_once __DIR__ . '/../vendor/autoload.php';
+$autoloader = require_once __DIR__ . '/../../autoload.php';
 
 const SIMPLETEST_SCRIPT_COLOR_PASS = 32; // Green.
 const SIMPLETEST_SCRIPT_COLOR_FAIL = 31; // Red.
diff --git a/index.php b/index.php
index 867f0e0..a44e5c5 100644
--- a/index.php
+++ b/index.php
@@ -14,7 +14,7 @@
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 
-$autoloader = require_once __DIR__ . '/core/vendor/autoload.php';
+$autoloader = require_once 'autoload.php';
 
 try {