Search code examples
phpsecuritydirectorylamp

Placing the PHP application folder above public_html

I saw in a thread and seen in some frameworks, that using the below structure is recommended. Can someone please explain why, in terms of security (if you can explain it thoroughly would be appreciated)? Are there any other advantages of this?

  • root
    • app
      • application_folder
      • config
      • controllers
      • models
    • public_html
      • css
      • js
      • images
      • index.php
      • .htaccess

EDIT:

Does this have any effect if the server was hacked?

Solution

  • The idea is that only the things that should be able to be accessed by the user are placed in public_html, so that random people on the Internet can't access random pieces of your code or data if they guess the right URL.

    The usual way this is done is to have a public folder inside the app which is then symlinked to public_html or under, and not actually split the application in two parts.