Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On shared hosting, we had occasional problems when the server's /tmp directory was full. Our hosting company suggested we change the session save path to be unique for each site.

ini_set('session.save_path', DOCUMENT_ROOT . '/_SESSIONS/');

Yes, that puts our sessions in the web root. We deal with potential privacy issues by including a .htacces file in that folder:

deny from all

This works.

We have now moved to our own managed server. The default session save path on this server is /var/lib/php/session. Is there any good reason to continue overwriting this to /var/www/vhosts/

share|improve this question
up vote 2 down vote accepted

I don't see any reason why you should need to change it from the default on a dedicated server, unless it happens to be set to a somewhere with a small partition and you're worried about running out of space (as was the case originally). I'm guessing the two paths on your new server are the same partition looking at the paths so that's a moot point now.

I personally would want it outside the webroot regardless of .htaccess security. It just doesn't make sense to put it there, then try to secure it, when it can just as easily be outside the website.

On a shared server I would probably want my sessions in my own directory. Depending on how good the security is, putting them in the same place as every other site could let other sites access my session data.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.