Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have many directories in a application like

root 
index.php
modules/ 
includes/ 
data/
themes/ 
and 
etc. 

I have placed index html file in every folder to make it simple secure. But i think there must be some better and more secure technique for security.

my question is how can we do it through htacess and php.

share|improve this question

migrated from stackoverflow.com May 1 '12 at 1:46

This question came from our site for professional and enthusiast programmers.

4 Answers 4

Move everything that doesn't need to be under the document root out.

share|improve this answer

Remember that you do not need to have all of your files in the publicly accessible part of your server's directory structure. Say you have your document root in:
/applicationname/www/

You can move things that the public doesn't need to see to:

/applicationname/includes/
/applicationname/data/
...etc.

You can still refer to these places in your code (as it uses the server's directory structure), but other people won't be able to access it as its outside your document root.

share|improve this answer

I would as Andrew, list them as /includes/ or /data/, but putting an index.html will still be a good idea. Depending on what you use the files for you can use IP-security. $_SERVER['REMOTE_ADDR'] == "your ip" in a simple if, of course if this in some sense should be publicly available this will not be a security.

share|improve this answer
    
i used simple technique. changed index.html to index.php. it contains header('location:/site-name/index.php'). it works... –  shuja Apr 30 '12 at 10:55
    
But that wouldn't prevent them from accessing /data/secret.php, would it? –  mikkeljuhl Apr 30 '12 at 11:10
    
mikkeljuhl, yes you are right .... –  shuja Apr 30 '12 at 12:55
Options -indexes

this will would have the same effect as putting a index.html file in every folder, so people would have to guess the url, instead of getting a nice list of filenames.

To protect the includes folder (and possibly the data as well) you could put a .htaccess file inside in that contains:

Order allow,deny
Deny from all
Satisfy All

This way nobody can access those files from the internet, only PHP can include/read them.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.