Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Why store the CakePHP files outside of the webroot?

For example, this is the way way that I have always been told to do it.


I know its because of security, but why? its not like the users can view files in the /app/ folder anyways. The htaccess prevents that correct?

If the user was able to get a malicious script on my webserver it wouldn't matter if the /app/ folder was in the /public_html/ or outside of the webroot, they would still alter the files under the /app/ folder, right?

So why bother?

share|improve this question
up vote 1 down vote accepted

Why take the risk? If they are not in the webroot they can never be served by Apache by mistake. Sure it shouldn't make a difference but it goes against the Principal of Least Privilege.

Also you would normally want to have your public folder as the root of the URL, sending people to looks a bit naff?

share|improve this answer
the fewer files that people have access to , the simpler your access logs will be. – djangofan Sep 17 '10 at 22:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.