I installed (via FTP) Bolt CMS only for a blog section of a website as I don't want to re-create the entire site in Bolt, just add a blog. I did this by adding all of Bolt's files in a folder www.mysite.com.au/blog and used the index page of Bolt as the blog page. It all works perfectly, however I am now concerned because I was reading through Bolt's documentation and it says to move the core Bolt files outside of 'public' for security, but the instructions don't cover the situation of wanting to keep Bolt separate from the rest of the site. My structure looks like this:
cache
etc
logs
mail
public_html
root
ssl
www
-index.php
-page1.php
-page2.php
-BLOG (Bolt folder)
--extensions
--files
--theme
--vendor
--src
--app
Is this a security risk? Should I move the Bolt extensions/vendor/app folders up above www, will that break anything? I am new, so if I wrote anything wrong or missed details please let me know. Thanks in advance!
You can do it like that, many used Bolt 2 that way. But of course, it's more secure when you move some parts out of the web accessible folder. But for that, I would suggest using Bolt with a subdomain like blog.yourdomain.com.