Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
Apache security

I've been reading up on server/apache security and I've run into a contradiction. I read that you shouldn't serve any files that aren't inside Apache's scope, but I've been told that you should keep files outside Apache's scope.

My current setup is:

Apache's scope: public_html/front. In the front folder I keep html, css, and javascript files. I also have a folder public_html/back, outside Apache's scope, which houses my PHP, database, and website backend files. All website directories and files have an owner/group of www-data. I'm running this all on Free BSD.

Should I have website files outside of Apache? Any other server security tips are appreciated.

share|improve this question
    
Belongs to serverfault. About the question, the files you should keep outside scope are those that bad guys must not see like configuration files for frameworks, .properties files, etc. Otherwise, you can broaden the scpe with alias and virtualhost so... that's not the point –  Alfabravo Dec 26 '11 at 23:07
add comment

migrated from stackoverflow.com Dec 29 '11 at 12:10

This question came from our site for professional and enthusiast programmers.

marked as duplicate by Chris S Feb 20 '12 at 20:11

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer

Files like application logic, configurations and htpasswd files should go in your private scope. Your public scope should only contain your primary index.php and files you would feel comfortable about if your visitors were to download them to their local PC, like images, javascript files and CSS files.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.