diff --git a/.htaccess b/.htaccess
index 7db5d3e5786887f4a4e1b28dba245dbe346d5e09..479f923b0006c427fac05d3ad180e9d87555b25d 100644
--- a/.htaccess
+++ b/.htaccess
@@ -138,7 +138,8 @@ DirectoryIndex index.php index.html index.htm
   # custom modules or to run another PHP application in the same directory.
   RewriteCond %{REQUEST_URI} !/core/modules/statistics/statistics.php$
   # Deny access to any other PHP files that do not match the rules above.
-  RewriteRule "^.+/.*\.php$" - [F]
+  # Specifically, disallow autoload.php from being served directly.
+  RewriteRule "^(.+/.*|autoload)\.php$" - [F]
 
   # Rules to correctly serve gzip compressed CSS and JS files.
   # Requires both mod_rewrite and mod_headers to be enabled.
diff --git a/autoload.php b/autoload.php
new file mode 100644
index 0000000000000000000000000000000000000000..690e09f8e9bfb130b17b7dd6f7c6602b26aed1ed
--- /dev/null
+++ b/autoload.php
@@ -0,0 +1,19 @@
+<?php
+
+/**
+ * @file
+ * Includes the autoloader created by Composer.
+ *
+ * This file can be edited to change the autoloader if you are managing a
+ * project's dependencies using Composer. If Drupal code requires the
+ * autoloader, it should always be loaded using this file so that projects
+ * using Composer continue to work.
+ *
+ * @see composer.json
+ * @see index.php
+ * @see core/install.php
+ * @see core/rebuild.php
+ * @see core/modules/statistics/statistics.php
+ */
+
+return require_once __DIR__ . '/core/vendor/autoload.php';
diff --git a/composer.json b/composer.json
index 9e870f112088d599135da47ed047687e24b12f7c..5bec2ee6f17040a141efa4fc4cd9693cbd8ea409 100644
--- a/composer.json
+++ b/composer.json
@@ -12,5 +12,11 @@
   "config": {
     "preferred-install": "dist",
     "autoloader-suffix": "Drupal8"
+  },
+  "extra": {
+    "_readme": [
+      "By default Drupal loads the autoloader from ./core/vendor/autoload.php.",
+      "To change the autoloader you can edit ./autoload.php."
+    ]
   }
 }
diff --git a/core/authorize.php b/core/authorize.php
index dbab02f39adb008938b363c163ae6782f8a7ed05..0d61004466c5b971b288097e7fdfdc227cb42d27 100644
--- a/core/authorize.php
+++ b/core/authorize.php
@@ -30,7 +30,7 @@
 // Change the directory to the Drupal root.
 chdir('..');
 
-$autoloader = require_once __DIR__ . '/vendor/autoload.php';
+$autoloader = require_once 'autoload.php';
 
 /**
  * Global flag to identify update.php and authorize.php runs.
diff --git a/core/install.php b/core/install.php
index 3493d4a7702c3546194541a6722a460f6018fab8..08c06e79acf3c4a65b0a547e95ccf13a9f9995d0 100644
--- a/core/install.php
+++ b/core/install.php
@@ -27,6 +27,6 @@
 }
 
 // Start the installer.
-$class_loader = require_once __DIR__ . '/vendor/autoload.php';
+$class_loader = require_once 'autoload.php';
 require_once __DIR__ . '/includes/install.core.inc';
 install_drupal($class_loader);
diff --git a/core/modules/statistics/statistics.php b/core/modules/statistics/statistics.php
index 4d2004646ae677a4afb40f9c17e29baaae234daf..fe1b9fd725881fc6cc131eccd15268394488d767 100644
--- a/core/modules/statistics/statistics.php
+++ b/core/modules/statistics/statistics.php
@@ -10,7 +10,7 @@
 
 chdir('../../..');
 
-$autoloader = require_once dirname(dirname(__DIR__)) . '/vendor/autoload.php';
+$autoloader = require_once 'autoload.php';
 
 $kernel = DrupalKernel::createFromRequest(Request::createFromGlobals(), $autoloader, 'prod');
 $kernel->boot();
diff --git a/core/modules/system/tests/http.php b/core/modules/system/tests/http.php
index 8c7d556be39f8d19091ca21d08643502bf680302..dfb03667262d39cb86f780b74d3899c33b7dbfea 100644
--- a/core/modules/system/tests/http.php
+++ b/core/modules/system/tests/http.php
@@ -10,7 +10,7 @@
 
 chdir('../../../..');
 
-$autoloader = require_once './core/vendor/autoload.php';
+$autoloader = require_once 'autoload.php';
 
 // Set a global variable to indicate a mock HTTP request.
 $is_http_mock = !empty($_SERVER['HTTPS']);
diff --git a/core/modules/system/tests/https.php b/core/modules/system/tests/https.php
index 702184df62702cfea5a354976b798916327d8d6e..038b4e640b1bc98052e8b40c1508ead12f6a62dc 100644
--- a/core/modules/system/tests/https.php
+++ b/core/modules/system/tests/https.php
@@ -13,7 +13,7 @@
 
 chdir('../../../..');
 
-$autoloader = require_once './core/vendor/autoload.php';
+$autoloader = require_once 'autoload.php';
 
 // Set a global variable to indicate a mock HTTPS request.
 $is_https_mock = empty($_SERVER['HTTPS']);
diff --git a/core/rebuild.php b/core/rebuild.php
index 7ca8af73bf2f9926f6b62b2700bbcd883307dd78..24474d05b4610a31c90c2a8fd61572366466ab4e 100644
--- a/core/rebuild.php
+++ b/core/rebuild.php
@@ -20,7 +20,7 @@
 // Change the directory to the Drupal root.
 chdir('..');
 
-$autoloader = require_once __DIR__ . '/vendor/autoload.php';
+$autoloader = require_once 'autoload.php';
 require_once __DIR__ . '/includes/utility.inc';
 
 $request = Request::createFromGlobals();
diff --git a/core/scripts/run-tests.sh b/core/scripts/run-tests.sh
index 2c13e752d1d9ef694399e7461abd2d6cbc056cf2..5da468ba7719b92f9acc31ce51e17411eee9605b 100644
--- a/core/scripts/run-tests.sh
+++ b/core/scripts/run-tests.sh
@@ -15,7 +15,7 @@
 use Drupal\simpletest\Form\SimpletestResultsForm;
 use Symfony\Component\HttpFoundation\Request;
 
-$autoloader = require_once __DIR__ . '/../vendor/autoload.php';
+$autoloader = require_once __DIR__ . '/../../autoload.php';
 
 const SIMPLETEST_SCRIPT_COLOR_PASS = 32; // Green.
 const SIMPLETEST_SCRIPT_COLOR_FAIL = 31; // Red.
diff --git a/index.php b/index.php
index 867f0e09215ae4f7a0bc0256e28ea89cc56850c4..a44e5c52b4e531eaf8c27950ac3c9919337858e8 100644
--- a/index.php
+++ b/index.php
@@ -14,7 +14,7 @@
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 
-$autoloader = require_once __DIR__ . '/core/vendor/autoload.php';
+$autoloader = require_once 'autoload.php';
 
 try {