Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I see that Apache and Nginx both use var/www as their web root - but that directory is not covered in the Filesystem Hierarchy Standard. I also see some servers with the web root in the /home/username/www directory. So where does the web root go? Or rather, where should it go most of the time for the common web server?

share|improve this question
I've answered two similar questions. See:… and… – Warner May 23 '10 at 19:22
up vote 2 down vote accepted

Many SysAdmins use non-standard paths in order to avoid easy-yo-guess path in case of attacks.

If you are building an Internet web server I suggest you to consider a non-standard path.

share|improve this answer
hmmm.. good point. I wonder how much help that would actually be in an attack. Kind of like switching the SSH port from 22. Should I create a root level nonstandard path like /www-data or just add to an existing path like /srv/www-data/? – Xeoncross May 23 '10 at 19:01
Putting SSH on a different port does not save you from a nmap portscan: in a few minutes nmap can guess the ssh port. Using non-standard path such as /MyData/WebSites/sitename01, /MyData/WebSites/sitename02 and so on can save you from various kind of vulnerability attacks that try to run or read some files using a relative path. If you take a look at a apache logfile, you can see some attacks using relative paths such as ../../../etc/passwd. That said, there is no silver bullet in security. – lrosa May 23 '10 at 19:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.