I am testing a simple site in Windows, XAMPP. There, I use some PHP files that must not be accessed directly for security reasons. After looking around, there are many methods to do this. The simplest seems to be define a constant and exit if it's not defined. While this works, I am looking for a more robust approach.

For this reason I decided to make my files not available to the web by putting them in a directory user's can't access from a browser.

Question: what's the recommended way to do this security and performance wise?

I am aware of 2 methods:

a) putting my files in ".;/path/to/php/pear"
b) modifying the htaccess file somehow


The common practice is to have the classic "public_html" folder, like this:


Everything under /home/my_site_folder belongs to your site, but only what is under /home/my_site_folder/public_html is being published to the world acting as the Apache's DocumentRoot.

So basically you use the public_html folder to put all your static content (images, css, js), scripts that are accessed by the user (like index.php) and the .htaccess with rewrite rules in case you need one. Everything else goes in the upper level folder /home/my_site_folder. The scripts under public_html will reach for everything they need there.

include "../something_needed.php";

This way you don't have to worry about what you don't want the user to access, you only have to worry about what he is supposed to.


The best way if you do not require the file to be accessed directly is to not publish it in your directory root. Just publish what you really need. Other required files can be imported(included/required in PHP) from the file system and don't need to be inside directory root.

Not the answer you're looking for? Browse other questions tagged or ask your own question.