I understand that having anything sensitive under webroot is not smart; someone may be able to access it via url. However, I do not have a choice with my web host (iPage) as they limit my server space to just the web root.

So my question is: how risky is it to just have sensitive files in a directory in a webroot with just simple forbidden public access? Any insight on this topic would be greatly appreciated.

EDIT: The 'sensitive files' are an installer for our startup's software and the php files that allow the download / control sql access.

  • Oh, and any recommendations on a new web host would also be very much appreciated. Currently looking at bluehost and liking what I see! – ink Sep 12 '14 at 16:13
  • 1
    How sensitive are we talking on a range from nuclear missile codes to your grandmothers favorite recipe? – Stephen Ostermiller Sep 12 '14 at 16:28
  • Hi Stephen, thank you for your query! I made an edit explaining what my sensitive files are. – ink Sep 12 '14 at 16:29
  • What is "simple forbidden public access"? – unor Sep 14 '14 at 12:36

Your risk is greater than if the files were completely outside the webroot simply because they are accessible on the web. This means you are relying on the web server to secure something which would otherwise be freely available to anyone with the correct URL. This results in an increased attack surface with exposure to web server vulnerability exploits, whereas leaving them outside the webroot requires an attacker to obtain a greater degree of system access.

On the other hand, some thoughts about the effectiveness of Security through obscurity with regards to file or directory names:

If the name of a specific file or directory is very difficult (or nearly impossible) to guess, e.g., its name is a GUID/UUID, then IMO the risk is greatly decreased because the difficulty of brute-forcing such a name is comparable to brute-forcing a complex password. Of course, this also means that legitimate access to such files becomes more difficult, but that's what bookmarks are for. Unauthenticated access might even be considered secure (to an extent; highly vulnerable to man-in-the-middle attacks) if the names are "sufficiently hard to guess" (this is the general criterion applied to a password).

Relying heavily on security through obscurity is generally discouraged, but my view is that we are indirectly practicing it all the time by using passwords.

  • Thanks for your answer darton! My question was more aimed at asking how risky it is to put files OUTSIDE webroot vs. on webroot with security settings as you mentioned. – ink Sep 12 '14 at 16:37
  • Ah, now I understand. Was actually editing my answer because I had some additional thoughts on that. – dartonw Sep 12 '14 at 16:38
  • Thank you for your answer! I've decided that moving the host is the ideal answer to this problem. Do you have any recommendations on web hosts? – ink Sep 12 '14 at 16:51
  • @ink, I've been with dreamhost.com for about 5 years and have zero complaints or desire to move. And this is coming from someone who was CTO of a web hosting company. – dartonw Sep 12 '14 at 16:57
  • Security through obscurity is generally discouraged? Not in my world! It is a very common practice but obviously not relied upon entirely. Observe best security practices always. – closetnoc Sep 13 '14 at 3:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.