diff --git a/.htaccess b/.htaccess
index 7db5d3e..479f923 100644
--- a/.htaccess
+++ b/.htaccess
@@ -138,7 +138,8 @@ DirectoryIndex index.php index.html index.htm
   # custom modules or to run another PHP application in the same directory.
   RewriteCond %{REQUEST_URI} !/core/modules/statistics/statistics.php$
   # Deny access to any other PHP files that do not match the rules above.
-  RewriteRule "^.+/.*\.php$" - [F]
+  # Specifically, disallow autoload.php from being served directly.
+  RewriteRule "^(.+/.*|autoload)\.php$" - [F]
 
   # Rules to correctly serve gzip compressed CSS and JS files.
   # Requires both mod_rewrite and mod_headers to be enabled.
diff --git a/autoload.php b/autoload.php
new file mode 100644
index 0000000..2b24d4c
--- /dev/null
+++ b/autoload.php
@@ -0,0 +1,11 @@
+<?php
+
+/**
+ * @file
+ * Includes the autoloader created by Composer.
+ *
+ * This file should be edited to change the autoloader if you are managing a
+ * project's dependencies using Composer.
+ */
+
+return require_once __DIR__ . '/core/vendor/autoload.php';
diff --git a/core/authorize.php b/core/authorize.php
index dbab02f..0d61004 100644
--- a/core/authorize.php
+++ b/core/authorize.php
@@ -30,7 +30,7 @@
 // Change the directory to the Drupal root.
 chdir('..');
 
-$autoloader = require_once __DIR__ . '/vendor/autoload.php';
+$autoloader = require_once 'autoload.php';
 
 /**
  * Global flag to identify update.php and authorize.php runs.
diff --git a/core/install.php b/core/install.php
index 3493d4a..08c06e7 100644
--- a/core/install.php
+++ b/core/install.php
@@ -27,6 +27,6 @@
 }
 
 // Start the installer.
-$class_loader = require_once __DIR__ . '/vendor/autoload.php';
+$class_loader = require_once 'autoload.php';
 require_once __DIR__ . '/includes/install.core.inc';
 install_drupal($class_loader);
diff --git a/core/modules/shortcut/images/favstar.png b/core/modules/shortcut/images/favstar.png
deleted file mode 100644
index bd51fde..0000000
--- a/core/modules/shortcut/images/favstar.png
+++ /dev/null
@@ -1,8 +0,0 @@
-‰PNG
-
-   IHDR   P      Øº×  ýIDATXGíXkPSGÞ{ó€@X§"tF?•‡RG…à³­Ö'Qe†¶´cSZ€z[!ZÚ:þ(ã@m%¼ÄGÕñl©ƒ"vF¢£h¬A^{»{á21$÷&ÈOw&™›Ý³ßžûížóÞ´×b ãš¼(Â×&«‘ÏÜ©<~ñN×¶ñÑÆ#”Á¾`lZ³ßÚF¨æ×ñáÌï6AuLçÂã$p,nÈ„G¼å„îzÅë88ÚxDúTå”ðiÙ¨Æ††Dn#½Ù#m/   	Í7™LÅ\xœ*dqùV@æ!@…¥jŠ«6Ô94o´ñr¶M&O^÷6Â.Ò·«jéÍi#Ò§×*df‘ÈZü‘[_À†ÅJ bõÌP€34ºë©ÌË²O¥)¹y$Ž6¡œåã'®Ú²#M„ü9¸÷pOwGg,¡n¬‰çñÎdíÉxÍÇ0*É#'P6{“}Ø2á§ÑUÓ'ÒÓ¦p‚‡a¤¯¶¨ZKl•RØ¯çŒ
-fÝì­Ó5óIå1±³è®U5àÊE½6kÿm…§¾Ñk§…¼3#äÃ>ˆG¿ï5?ÔœÐœV°’PëéÜJ(¥  eð18 ¯sé,Jö¤DünÊãeUÏÐää•±ãmÅ$ÕS1q†gÿ’ž8 ’Ö/•E’±ÊÜfGÔG-6k{ Wòw$xP<Z¾NßØõÖ¸qô	<–_fyôÈä(PIL¤çÀU€(ØW		”ÒÊe±™†l£]£ ©E§Ã¾Ož—Šá`™“¾¡)º®òÁa#Pµ-úbŸµo¡ãšs¥±–Ä‰Þöýœ>ß{³¦ÖËÑÖK(¸¸cß­Å¨wZx9†åŽ6aSß­”ÉW'0ý–ž^pägmkW—%ˆ&5D Ð¤èTÒ*ÖÄj­¥ÒéªëÃÙµvÕ¬Ÿ·IST%÷!ÍÕL8ïÙÙ½>E!
-Äé‹3ƒ»MÍ D[Ú³ó ÁéáæµŠ$ãä)“#¹ ‰……Àôôc:DÞ Ÿˆ@$<AIRù'Š«/sÚ¯Kš=Ç±T`³f2ââ.ž»¢äÎãó«–¬X"Ššá‰{ îÖp¶ül­¿H\Àq}Âüø†„Ä¹ql€46“é¶g&'å@ú¥1Á&
-`õÚâëùîxI‡3 ÂeÍsTfOñ¸r zioï²ˆ¨ˆÀ÷—.¢Îü=wú|_ƒ¡¾ÕÒm"ðª2ˆ„„›“?Ý0¶ö8ˆ¼_Oƒ§OŸ£nÃàX¤=‰¯ˆ}K#VŒºÏ¥´HQ……ò^vf¸Oð¸¤C
-‡ÀklÌUÁ+’–Ù6¹ødY×¿wï=¶ö¶Ír%(´pàbý„À€ŽÏ¿úlŽ#Þ©ò«ÀP×üýÅmíÿu†ÒãB ‡ß(ôaŠIqªÂŠ5qPœ	ÅÐîØ0ÆîØºC ƒsµ+;“5H¾ÏÊ°v«$r…‡Nà…U`á‚˜zñøéÜA—1B †"¢{OïªùŒ ¸ò	;åŒ»xî¤æò„S&±õæûúl}æ ®rfð>Ø•5†Í‡¼ÜŸ6´?|ÖoØ!EÅùø2X¾d°Ê×ÌV‘ýdÅÉÒšlvîâ¡œÉëè5qÕ—ÄæðAA¿¥~ñ‰/ÛºùGu¶¶>I&Õ—³Ù!<‘·7ñmæfVE>sÈÐc±ŽxÃ„ÄÐ¥SÿÉd³Ãöêƒ¥ÎL©ãhçÊÉÑÆƒwU"a^ünø¡—4Þ J‹Ê-èyÕšÞL©Syå€ŸïˆÜ‚•@ˆ65LÊÔÍÿ4tÚ’qhì{Á”:°¯²©±IïˆçŒ@U?´Þí]÷ûÇøÉ1œšoë·ÑW7TëQ$v™ÿ²Ckñ÷åc@îÎIM¼2gÖÉäI‘Çýåk½µß"mI_Ýx8®ž9“Î÷zúäÐi‹Ûrn¢Â×e#Ò¦é×®—I&O)Ö–Üniy‹»z JOªK’¯žþÐø°åäï:3q¸Aj6Œ@”ð)ŠRÃJ]NQÀÈoïT3a…òY¿¿X	Ç‚á˜Þ^”îˆÍhâ¡„¿|ÕRpéÂ•n‹¥Wo³š×3y	å3¡×¸"·`ñ<ŸS¥g8…áIçÅÿuíêŸÁ6’ªÅ¨Ž{<
-ó+àáXt|â\£þÊµ9ŽÂä*„ÃÙò“×àNÔ;^õ·z0„GooFô>øÇä‚^k_¶«ü†òš—@˜ppi‡ªv;WÃ“&…5¡š”žLîf[ìÍØpþy®ÎB?¯®    IEND®B`‚
\ No newline at end of file
diff --git a/core/modules/shortcut/images/shortcut-active.png b/core/modules/shortcut/images/shortcut-active.png
deleted file mode 100644
index 214bd30..0000000
--- a/core/modules/shortcut/images/shortcut-active.png
+++ /dev/null
@@ -1,3 +0,0 @@
-‰PNG
-
-   IHDR         Ä´l;   tEXtSoftware Adobe ImageReadyqÉe<   ŸIDATxÚbd@ÿÿÿw RäƒŒŒŒ@4	¡õ”Lƒ.f 5»ÁÿþýŠÑÈã•*6 q 13¡»¾ ”6	ÒŽ@þ\jI1¸QTTd(Èp } (f'×`ŠbbbèÞŠ} ‰C-¸@¬Á€¸P\\ÜˆàG ü ^Õ—0 M×Èý}\¸Y    IEND®B`‚
\ No newline at end of file
diff --git a/core/modules/shortcut/images/shortcut.png b/core/modules/shortcut/images/shortcut.png
deleted file mode 100644
index 739a8d0..0000000
--- a/core/modules/shortcut/images/shortcut.png
+++ /dev/null
@@ -1,3 +0,0 @@
-‰PNG
-
-   IHDR         Ä´l;   tEXtSoftware Adobe ImageReadyqÉe<   ²IDATxÚbd@gÎœq Räƒ&&&@4	¡õ”LƒÿýûÇ@-@ƒÿþý;Ä\<Æ£A1#-(6 q 13¡»¾ðÿÿÃÈÈÈ@ íä?À¥–ƒ££££¢¢.€Ô é@1C8Ñƒ‚†Š@(ÆÆÆ6 {(ö$² ¨ö²>|‘÷‘‘±1!!a¡pŒùÂpþüùÀ B©+ ´éÊ"Ôòµ    IEND®B`‚
\ No newline at end of file
diff --git a/core/modules/statistics/statistics.php b/core/modules/statistics/statistics.php
index 4d20046..fe1b9fd 100644
--- a/core/modules/statistics/statistics.php
+++ b/core/modules/statistics/statistics.php
@@ -10,7 +10,7 @@
 
 chdir('../../..');
 
-$autoloader = require_once dirname(dirname(__DIR__)) . '/vendor/autoload.php';
+$autoloader = require_once 'autoload.php';
 
 $kernel = DrupalKernel::createFromRequest(Request::createFromGlobals(), $autoloader, 'prod');
 $kernel->boot();
diff --git a/core/modules/system/tests/http.php b/core/modules/system/tests/http.php
index 8c7d556..dfb0366 100644
--- a/core/modules/system/tests/http.php
+++ b/core/modules/system/tests/http.php
@@ -10,7 +10,7 @@
 
 chdir('../../../..');
 
-$autoloader = require_once './core/vendor/autoload.php';
+$autoloader = require_once 'autoload.php';
 
 // Set a global variable to indicate a mock HTTP request.
 $is_http_mock = !empty($_SERVER['HTTPS']);
diff --git a/core/modules/system/tests/https.php b/core/modules/system/tests/https.php
index 702184d..038b4e6 100644
--- a/core/modules/system/tests/https.php
+++ b/core/modules/system/tests/https.php
@@ -13,7 +13,7 @@
 
 chdir('../../../..');
 
-$autoloader = require_once './core/vendor/autoload.php';
+$autoloader = require_once 'autoload.php';
 
 // Set a global variable to indicate a mock HTTPS request.
 $is_https_mock = empty($_SERVER['HTTPS']);
diff --git a/core/rebuild.php b/core/rebuild.php
index 7ca8af7..24474d0 100644
--- a/core/rebuild.php
+++ b/core/rebuild.php
@@ -20,7 +20,7 @@
 // Change the directory to the Drupal root.
 chdir('..');
 
-$autoloader = require_once __DIR__ . '/vendor/autoload.php';
+$autoloader = require_once 'autoload.php';
 require_once __DIR__ . '/includes/utility.inc';
 
 $request = Request::createFromGlobals();
diff --git a/core/scripts/run-tests.sh b/core/scripts/run-tests.sh
index 7bf821c..38c7b9f 100644
--- a/core/scripts/run-tests.sh
+++ b/core/scripts/run-tests.sh
@@ -11,7 +11,7 @@
 use Drupal\Core\Test\TestRunnerKernel;
 use Symfony\Component\HttpFoundation\Request;
 
-$autoloader = require_once __DIR__ . '/../vendor/autoload.php';
+$autoloader = require_once __DIR__ . '/../../autoload.php';
 
 const SIMPLETEST_SCRIPT_COLOR_PASS = 32; // Green.
 const SIMPLETEST_SCRIPT_COLOR_FAIL = 31; // Red.
diff --git a/index.php b/index.php
index 867f0e0..a44e5c5 100644
--- a/index.php
+++ b/index.php
@@ -14,7 +14,7 @@
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 
-$autoloader = require_once __DIR__ . '/core/vendor/autoload.php';
+$autoloader = require_once 'autoload.php';
 
 try {