Member Avatar for ryy705

Hello,
I just signed up with a free hosting provider. When I login through ftp I go to my root directory which is web accessible. So where do I hide the files that I don't want to be accessed through the web? Such as database connection files, user uploaded files, etc. Are all hosting services the same? Or do some of them give access to directories that are not web accessible? This first I am trying put an actual website up so I would appreciate any help. Thanks.

  • 2 Contributors
  • 2 Replies
  • 122 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by ryy705

Dani AI

Generated

Direct, practical options for (and following ): when your FTP lands in the web root, treat anything under that root as potentially public. The safest pattern is to put secrets and raw uploads outside the document root; if your host does not allow that, fall back to server-side access controls and serving files through PHP so the filesystem never exposes raw files.

Place config files one level above the web directory and include them. Example layout:

/home/youruser/
    config.php
    public_html/
        index.php

Include from code in public_html:

<?php
require_once __DIR__ . '/../config.php';

If you cannot reach a parent directory, use an Apache access rule to block direct HTTP access to sensitive files. Example that supports both Apache 2.2 and 2.4:

<FilesMatch "^(config\.php|.*\.ini|.*\.inc)$">
  <IfModule mod_authz_core.c>
    Require all denied
  </IfModule>
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  </IfModule>
</FilesMatch>

For user uploads: never allow direct execution. Store uploads outside webroot and serve them via a PHP gate that checks authentication/authorization, validates input (no path traversal), sets correct headers, then readfile() the file. Use randomized storage names and keep original names in the database.

File permissions: keep config files readable only by the account that needs them (e.g., 640/600 or 640/750 depending on server user mapping). Test by trying to request the file from a browser — you should get a 403 or no content. If the host prevents placing files outside public_html, ask support or upgrade to a host that provides a proper home directory.

Recommended Answers

All 2 Replies

Member Avatar for peter_budo

Can you provide some more details on the hardware setup such as server type (Apache, IIS, Tomcat) supported technologies PHP, ASP, JSP type of database etc. Just to provide you with relevant info not to give general data

Member Avatar for ryy705

Thank you for replying. Its an apache server with php and mysql.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.