[error] Message: Error executable_php, access was denied to the file.

Hi @MahmoudSayed96, I can replicate the same issue in my local setup.
You can take create a sibling folder of webroot named drush in you project directory and create a drush.yml file inside that with the following details.

options:
  uri: '<your_site_url>'

Ref: https://drupal.stackexchange.com/questions/197651/how-i-change-my-site-u...
In this way, you can set the drush uri, which can resolved the issue. Please check this way and let me know if it's worked for you.
I'm attaching the screenshot here after following the above mentioned steps.

I am seeing the same Error executable_php, access was denied to the file. error message, both when I run security review in the browser or via drush (and I do have a drush file with the site URI specified); the difference is that I actually see the security review results in the browser (in addition to the error message), whereas via drush there is no review output.

Hi @bgustafson, Previously I have uploaded the screenshot of the terminal after running drush secrev now I'm attaching here the screenshot of the page after running the security review from the following url /admin/reports/security-review. Still I'm not getting any executable_php error.

I think there maybe some permission related issue. For the clarification I'm attaching here the file permissions of the particular file and /sites/default/files folder.

Thanks !

@bgustafson if you can check what was posted in #4

I have the same effect as colleague @bgustafson in the browser. I don't use drush to confirm the second symptom. Access rights are ok.

This rule in Drupal's .htaccess file denies access to PHP files:

  # For security reasons, deny access to other PHP files on public sites.
  # Note: The following URI conditions are not anchored at the start (^),
  # because Drupal may be located in a subdirectory. To further improve
  # security, you can replace '!/' with '!^/'.
  # Allow access to PHP files in /core (like authorize.php or install.php):
  RewriteCond %{REQUEST_URI} !/core/[^/]*\.php$
  # Allow access to test-specific PHP files:
  RewriteCond %{REQUEST_URI} !/core/modules/system/tests/https?\.php
  # Allow access to Statistics module's custom front controller.
  # Copy and adapt this rule to directly execute PHP files in contributed or
  # custom modules or to run another PHP application in the same directory.
  RewriteCond %{REQUEST_URI} !/core/modules/statistics/statistics\.php$
  # Deny access to any other PHP files that do not match the rules above.
  # Specifically, disallow autoload.php from being served directly.
  RewriteRule "^(.+/.*|autoload)\.php($|/)" - [F]

So the check not being able to fetch the PHP file should not be an error, it should mean Drupal is correctly protected and make the check succeed.

Comment in MR

Thanks!