I've developed a PHP framework that operates with the directory structure of

/www/ (public_html)

But I've come across a host that only allows ftp to the DocumentRoot, so this imposes a security risk to my scripts. I don't want the root of the site to point to the root where my framework lies.

I've asked a question over at stackoverflow with a question to an .htaccess rewriterule to potentially solve this

Is there a better method to do this?

2 Answers 2


Presumably you just need to block HTTP access (return an HTTP status code of 403 - Forbidden) to these folders, if stored in the document root? In your document root .htaccess file:

# Block HTTP access to certain folders
RewriteRule ^classes/.* - [F]
RewriteRule ^templates/.* - [F]

(...and build flexibility into your framework to allow your framework to be located at the same level as the public HTML.)

If I understand your other/alternative question correctly... I can't see any benefit in trying to fake a document root using rewrite rules. Presumably this is to maintain the directory structure? I don't think this will add any more security and just introduces an additional layer of complexity IMO.

  • This was my next option if. I guess I am making things more difficult haha Mar 14, 2013 at 2:53
  • The main reason was to prevent and collisions on client files and framework files and their names or locations. Edit: I realized I can make my framework in a directory like wp. And have a config file. Mar 14, 2013 at 3:02

The better solution is to code so that there is no security risk from someone requesting these files. Remember that since PHP is interpreted at the server-side then you can code your files to return an empty document or redirect elsewhere when requested.

This is what Wordpress does. Try asking for any of the files you are not supposed to and what the browser gets is simply an empty document. Even if you ask for wp-config.php which is the standard file containing the most sensitive access information, what you get is simply nothing.

  • I did notice that. Probably good practice even if the files are one directory up. Thanks for the advice. Mar 14, 2013 at 2:54
  • 1
    While this is true, security is all about layers. Moving sensitive code outside the web root adds an extra layer of security, for example in the (rare) situation of server misconfiguration it could mean the code from PHP files gets displayed/served instead of executed. Mar 14, 2013 at 14:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.