I've read that you can put php files outside of the document root of virtual hosts and that it can prevent people from accessing the .php files as well as prevent people from being able to download the php if the server messes up badly. Also seems like it may be easier than messing with a bunch of slow loading .htaccess files. So let's say my website's apache is setup like:

<VirtualHost *:80>
        ServerAdmin webmaster@localhost
        DocumentRoot /var/www/sitehtml

My /var/www/:


Is it good practice to keep .php files outside of the sitehtml directory that is served up to visitors and try to keep them in the sitephp directory?

Are there any downsides to doing it this way compared to keeping everything in sitehtml?

closed as primarily opinion-based by Sven Jul 11 at 6:26

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Welcome to ServerFault. Your question is likely to be closed as the best practices change all the time. What is considered as a good practice today may not be true after a few months or years. That said, it is normal to keep PHP files under sitehtml (that is mentioned in OP). – Pothi Kalimuthu Jul 11 at 4:59