<p>You should always be careful with PHP source files in a public folder. Typically it's fine, however a small mistake in the server's configuration can lead to big problems. It might cause .php files not to be processed by PHP, leading to leaked source files.</p>

<p>This famously <a href="https://techcrunch.com/2007/08/11/facebook-source-code-leaked/" rel="nofollow">happened with Facebook in 2007</a>.</p>

CC BY-SA 3.0
2016-08-03T14:44:33.817Z
The php files actually have no connection whatsoever with the CMS. Does that make it better?
Amit Erandole
CC BY-SA 3.0
2016-08-04T10:41:31.657Z
The source files might show credentials like passwords and secret keys. They may also expose exploits a hacker can use one the configuration has been restored. It's not uncommon that custom scripts have some security exploids. However these are often hard to identify without access to the source code.
Arnold Daniels
CC BY-SA 3.0
2016-08-03T09:16:36.477Z
2016-08-04T10:37:26.623Z
2016-08-04T10:37:26.623Z
Arnold Daniels
<p>As long as the PHP files themselves don't introduce any security holes, having them in your web root is perfectly fine. That's not uncommon at all. How they were written makes all the difference, of course. If you aren't sure whether the developer followed best practices for the security of the mailer scripts, that might be of some concern.</p>

CC BY-SA 3.0
2016-08-03T03:20:14.247Z
2016-08-03T03:20:14.247Z
Todd Prouty
<p>I just ‘discovered’ that the developer on my client’s craft website has been migrating his old landing pages to the new setup by cramming the older static pages into the public directory instead of using the CMS. </p>

<p>There are a lot of PHP files there but they are mostly using a PHP mailer setup - not any database queries.</p>

<p>My question is: how dangerous or safe is it to have PHP files in the public directory?</p>

<security>
Is it safe to have PHP files in the public directory of a craft cms website?
# Is it safe to have PHP files in the public directory of a craft cms website?

(Asked by: username_0 on 2016-08-03)

I just ‘discovered’ that the developer on my client’s craft website has been migrating his old landing pages to the new setup by cramming the older static pages into the public directory instead of using the CMS.

There are a lot of PHP files there but they are mostly using a PHP mailer setup - not any database queries.

My question is: how dangerous or safe is it to have PHP files in the public directory?

**Tags:** security

---

## 2 answers

### Answer by username_2 on 2016-08-03. Score: 7 | Accepted answer

As long as the PHP files themselves don't introduce any security holes, having them in your web root is perfectly fine. That's not uncommon at all. How they were written makes all the difference, of course. If you aren't sure whether the developer followed best practices for the security of the mailer scripts, that might be of some concern.


---

### Answer by username_1 on 2016-08-03. Score: 3

You should always be careful with PHP source files in a public folder. Typically it's fine, however a small mistake in the server's configuration can lead to big problems. It might cause .php files not to be processed by PHP, leading to leaked source files.

This famously [happened with Facebook in 2007](https://techcrunch.com/2007/08/11/facebook-source-code-leaked/).

> **Comments:**
> **username_0**: The php files actually have no connection whatsoever with the CMS. Does that make it better?  
> **username_1**: The source files might show credentials like passwords and secret keys. They may also expose exploits a hacker can use one the configuration has been restored. It's not uncommon that custom scripts have some security exploids. However these are often hard to identify without access to the source code.  

---

