Home/ Questions/Q 8204637
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-07T07:57:32+00:00

I’ve been told it’s good practice to keep as much of my PHP files

  • 0

I’ve been told it’s good practice to keep as much of my PHP files outside of public_html whenever possible.

It’s been suggested to me to use define magical constants to refer to files outside of public_html which is fine, I can go one directory up out of public_html by doing that.

My question now is this:

  1. What are the differences between webroot and document root?

  2. To prevent stuff like directory traversing, is it OK to just refer to a folder one directory up outside of public_html? Or do I need to go further, many directories up to ensure those files cannot be accessed?

I also want not just to avoid/prevent directory traversing but to hide important files like my connection file that contains my MySQL username and login details every time it makes a connection for example.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Webroot and document root are just two different terms that, in the case of web development, mean the same thing.

    Only files inside the webroot (in your case public_html) can be accessed over the web. Anything outside of it can only be accessed by the server itself. So, you can create a folder next to public_html for all your web-related files that you don’t want web-accessible.

    However, bear in mind that users won’t ever see the PHP source, since it gets executed before the file is sent to the user. So that means that even if a user tries to access your “connect to the database” file, all they’ll get is an empty page, and no trace of your login credentials.

    • 0