Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Apache security

I've been reading up on server/apache security and I've run into a contradiction. I read that you shouldn't serve any files that aren't inside Apache's scope, but I've been told that you should keep files outside Apache's scope.

My current setup is:

Apache's scope: public_html/front. In the front folder I keep html, css, and javascript files. I also have a folder public_html/back, outside Apache's scope, which houses my PHP, database, and website backend files. All website directories and files have an owner/group of www-data. I'm running this all on Free BSD.

Should I have website files outside of Apache? Any other server security tips are appreciated.

share|improve this question

migrated from Dec 29 '11 at 12:10

This question came from our site for professional and enthusiast programmers.

marked as duplicate by Chris S Feb 20 '12 at 20:11

This question was marked as an exact duplicate of an existing question.

Belongs to serverfault. About the question, the files you should keep outside scope are those that bad guys must not see like configuration files for frameworks, .properties files, etc. Otherwise, you can broaden the scpe with alias and virtualhost so... that's not the point – Alfabravo Dec 26 '11 at 23:07

Files like application logic, configurations and htpasswd files should go in your private scope. Your public scope should only contain your primary index.php and files you would feel comfortable about if your visitors were to download them to their local PC, like images, javascript files and CSS files.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.