diff --git a/.htaccess b/.htaccess
index c32b182..d9f0989 100644
--- a/.htaccess
+++ b/.htaccess
@@ -3,7 +3,7 @@
 #
 
 # Protect files and directories from prying eyes.
-<FilesMatch "\.(engine|inc|info\.yml|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\.php)?|xtmpl)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig\.save)$">
+<FilesMatch "\.(engine|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig\.save)$">
   <IfModule mod_authz_core.c>
     Require all denied
   </IfModule>
diff --git a/core/modules/system/src/Tests/System/HtaccessTest.php b/core/modules/system/src/Tests/System/HtaccessTest.php
new file mode 100644
index 0000000..4f03f04
--- /dev/null
+++ b/core/modules/system/src/Tests/System/HtaccessTest.php
@@ -0,0 +1,29 @@
+<?php
+
+/**
+ * @file
+ * Contains Drupal\system\Tests\System\HtaccessTest
+ */
+
+namespace Drupal\system\Tests\System;
+
+use Drupal\Core\Site\Settings;
+use Drupal\simpletest\WebTestBase;
+
+/**
+ * Tests access restrictions provided by the default .htaccess file.
+ *
+ * @group system
+ */
+class HtaccessTest extends WebTestBase {
+
+  /**
+   * Tests accessind disallowed file extensions.
+   */
+  function testDisallowedExtensions() {
+    // Try accessing a yml file.
+    $this->drupalGet('core/core.services.yml');
+    $this->assertResponse(403);
+  }
+
+}