Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been reading up on server/apache security and I've run into a contradiction. I read that you shouldn't serve any files that aren't inside Apache's scope, but I've been told that you should keep files outside Apache's scope.

My current setup is:

Apache's scope: public_html/front. In the front folder I keep html, css, and javascript files. I also have a folder public_html/back, outside Apache's scope, which houses my PHP, database, and website backend files. All website directories and files have an owner/group of www-data. I'm running this all on Free BSD.

Should I have website files outside of Apache? Any other server security tips are appreciated.

share|improve this question

If you want the files served by Apache, they should be accessible by Apache.

However, you should not let Apache have write access to any files which it is not required.

If you have an upload directory, you can make Apache able to write in that directory, but it must not be able to write in your PHP files, css and such.

share|improve this answer
Everything works fine with the current setup, I'm not sure why there might be a security risk if my php security files are outside Apache's scope. – Paul Dec 27 '11 at 1:52
How do you define Apache's scope? If a script is vulnerable to some attack, it can possibly read a lot of files on the system. And if the files are writable by www-data it will be possible write to the files via that. – Frands Hansen Dec 27 '11 at 3:20
Inside of Apache's config file, where you set DocumentRoot, I have it set to public_html/front, which contains html, css, and js files. But I keep all the important php, db and everything inside public_html/back. – Paul Dec 27 '11 at 22:12
And how to web users access dynamically generated web pages (PHP) then? – Frands Hansen Dec 28 '11 at 3:49
I have a page which sends a request to the backend files, then after the data is gathered, I have it call a frontend file which renders the html. – Paul Dec 30 '11 at 0:25

Your setup is perfectly acceptable and I'd say it's even recommended.

Your DocumentRoot should ideally point only at files that need to be served to end users. Scripts and other assets that are used by your client-facing scripts can sit in a different directory (e.g. public_html/back as you have it). For example, your configuration files, database connectivity classes etc would sit in the non-public folders.

If you put everything under DocumentRoot, then you would have to secure those files so they don't get served to end users (for example, by blocking their download using .htaccess or using PHP to kill the request when those files are loaded directly).

One note I would have is that the name "public_html" suggests public facing files. In our company we have the DocumentRoot point to public_html (or equivalent) and the "back" files under a totally different directory as to avoid confusion.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.