diff --git a/core/composer.json b/core/composer.json
index 87e3926..fe3026d 100644
--- a/core/composer.json
+++ b/core/composer.json
@@ -145,6 +145,7 @@
     "autoloader-suffix": "Drupal8"
   },
   "scripts": {
-    "pre-autoload-dump": "Drupal\\Core\\Composer\\Composer::preAutoloadDump"
+    "pre-autoload-dump": "Drupal\\Core\\Composer\\Composer::preAutoloadDump",
+    "post-autoload-dump": "Drupal\\Core\\Composer\\Composer::ensureHtaccess"
   }
 }
diff --git a/core/lib/Drupal/Core/Composer/Composer.php b/core/lib/Drupal/Core/Composer/Composer.php
index 297f380..ecfeb0f 100644
--- a/core/lib/Drupal/Core/Composer/Composer.php
+++ b/core/lib/Drupal/Core/Composer/Composer.php
@@ -36,4 +36,46 @@ public static function preAutoloadDump(Event $event) {
     $package->setAutoload($autoload);
   }
 
+  /**
+   * Ensures that .htaccess and web.config files are present in Composer root.
+   *
+   * @param \Composer\Script\Event $event
+   */
+  public static function ensureHtaccess(Event $event) {
+
+    // The current working directory for composer scripts is where you run
+    // composer from.
+    $vendor_dir = $event->getComposer()->getConfig()->get('vendor-dir');
+
+    // Prevent access to vendor directory on Apache servers.
+    $htaccess_file = $vendor_dir . '/.htaccess';
+    if (!file_exists($htaccess_file)) {
+      $lines = <<<EOT
+<IfModule mod_authz_core.c>
+  Require all denied
+</IfModule>
+<IfModule !mod_authz_core.c>
+  order deny,allow
+  deny from all
+</IfModule>
+EOT;
+      file_put_contents($htaccess_file, $lines . "\n");
+    }
+
+    // Prevent access to vendor directory on IIS servers.
+    $webconfig_file = $vendor_dir . '/web.config';
+    if (!file_exists($webconfig_file)) {
+      $lines = <<<EOT
+<configuration>
+  <system.webServer>
+    <authorization>
+      <deny users="*">
+    </authorization>
+  </system.webServer>
+</configuration>
+EOT;
+      file_put_contents($webconfig_file, $lines . "\n");
+    }
+  }
+
 }
diff --git a/core/modules/system/src/Tests/System/HtaccessTest.php b/core/modules/system/src/Tests/System/HtaccessTest.php
index 94bfe20..8a44715 100644
--- a/core/modules/system/src/Tests/System/HtaccessTest.php
+++ b/core/modules/system/src/Tests/System/HtaccessTest.php
@@ -44,6 +44,9 @@ protected function getProtectedFiles() {
       $file_paths[] = "$path/access_test.$file_ext";
     }
 
+    // Try and access a non PHP file in the vendor directory.
+    $file_paths[] = 'core/vendor/composer/installed.json';
+
     return $file_paths;
   }
 
diff --git a/core/vendor/.htaccess b/core/vendor/.htaccess
new file mode 100644
index 0000000..e311d48
--- /dev/null
+++ b/core/vendor/.htaccess
@@ -0,0 +1,7 @@
+<IfModule mod_authz_core.c>
+  Require all denied
+</IfModule>
+<IfModule !mod_authz_core.c>
+  order deny,allow
+  deny from all
+</IfModule>
diff --git a/core/vendor/web.config b/core/vendor/web.config
new file mode 100644
index 0000000..2e065e2
--- /dev/null
+++ b/core/vendor/web.config
@@ -0,0 +1,7 @@
+<configuration>
+  <system.webServer>
+    <authorization>
+      <deny users="*">
+    </authorization>
+  </system.webServer>
+</configuration>