<p>As André mentioend, everything inside your <code>public</code> folder should go inside FastHosts' <code>htdocs</code> folder. Public is just what Craft says should go in your publicly accessible web "root". </p>

<p>On most hosts I've seen, you should be able to put the Craft folder on the same level where <code>htdocs</code> lives. Generally I've found shared hosting to look like this:</p>

<p><code>/yourhomefolder/domain.com/htdocs/index.php</code></p>

<p>If you have an htdocs folder, everything inside what's in your <code>public</code> folder will go in there and the <code>craft</code> folder will go inside your domain.com folder, up one level. </p>

<p>If the host is running something like cpanel, you can usually change which folder your website domain's root is going to be. In that case, just keep your public folder, and then point the domain's "root" to be that folder, instead of htdocs:</p>

<p><code>/yourhomefolder/domain.com/htdocs/public/index.php</code></p>

<p>If you don't have a control panel option, sometimes contacting support and asking them if that's possible can help.</p>

CC BY-SA 3.0
2015-05-26T05:07:30.997Z
2015-05-26T05:07:30.997Z
RitterKnight
<p>It's not so much that you can't have the index.php file in a subfolder that might be an issue; it is that you can't put the <code>craft</code> folder above your webroot. If you have access to the folder that <code>htdocs</code> is inside, you should try putting the <code>craft</code> folder inside that. It might not be obvious, but there's no reason that the <code>public</code> folder has to be named public. It could be <code>html</code>, <code>htdocs</code>, or <code>whatever</code>. The point is that you're suppose to put the <code>craft</code> folder above this folder.</p>

<p>On many "simple" webhosts, you may not be allowed to do this, and you have to put the <code>craft</code> folder within your <code>public</code> folder. The security risk involved with doing this is, as the warning states, related to your <code>craft</code> folder being directly accessible through a webbrowser. For instance, you're <code>db.php</code> config file would now be "accessible" by going to <code>http://yourdomain.com/craft/config/db.php</code>. As long as your webserver is configured correctly, and there are no security holes to exploit, this doesn't really matter, since the file will be processed as php, and doesn't output anything. </p>

<p>But, in theory, if a malicious user manages to, for instance, crash the php process, he'd see the file as pure text. Or, if he's able to initiate a download of a file inside your public root, he'd be able to get to all your configuration files. But, then again, you might have problems even if the craft folder is outside of your public root.</p>

<p>If you can't put <code>craft</code> outside your public root folder, options 2) and 3) doesn't really help, they just introduce more problems. Just put the files in your <code>public</code> folder, and the <code>craft</code> folder, inside your <code>htdocs</code> folder, and reconfigure the path to craft in index.php to:</p>

<pre><code>$craftPath = './craft';
</code></pre>

<p>Then, make sure that inside your <code>craft</code> folder the .htaccess file that comes with Craft is still there. It's suppose to say:</p>

<pre><code>deny from all
</code></pre>

<p>This should, under normal circumstances, deny direct access to the <code>craft</code> folder.</p>

CC BY-SA 3.0
2015-05-24T14:09:03.300Z
2015-05-24T14:09:03.300Z
André Elvan
<p>I’ve got a small, low traffic site that I’ve rewritten with Craft and a Bootstrap responsive grid, mainly as a learning exercise. The original site has just a dozen static pages, and is hosted with Fasthosts UK-based shared hosting. My new site, although small, makes extensive use of Craft’s Matrix. I’ve learned a lot and I’m really pleased with it.</p>

<p>I’ve started to install the new site (alongside the old one) and I’ve discovered that Fasthosts shared hosting doesn’t allow the new index.php file to be located inside a ‘public’ sub-folder – it has to be at the root of the htdocs folder. So my first option seems to be to empty the contents of my ‘public’ folder into my htdocs folder, to live alongside the craft folder.</p>

<p>There are stern, but mysterious, warnings about doing this in Craft’s installation documentation: "We recommend that you upload the folder above your web root if possible, which will ensure that no one can access any of its files directly. (Your web root is the folder that your domain name points to.) That’s not a requirement, but do it if you can. For the children.” </p>

<p>Could someone please explain what bad things might happen if I take this first option?</p>

<p>I did a bit of research before I posted this question, and I came across a second option to leave everything in the public folder and to use mod_rewrite code in the .htaccess file to re-route requests for index.php into the public folder.</p>

<p>Lastly, I found a third option of creating an extra index.php file located in the htdocs folder to point to index.php the public folder, with this re-direction code:</p>

<p><code>&lt;?php
header('Location: http://mydomain.com/public');
exit;
?&gt;</code></p>

<p>Which of these three options is the best compromise from a security / SEO / performance perspective?</p>

<install><htaccess>
How do I install Craft in shared hosting that doesn't allow index.php in a sub-folder
# How do I install Craft in shared hosting that doesn't allow index.php in a sub-folder

(Asked by: username_0 on 2015-05-24)

I’ve got a small, low traffic site that I’ve rewritten with Craft and a Bootstrap responsive grid, mainly as a learning exercise. The original site has just a dozen static pages, and is hosted with Fasthosts UK-based shared hosting. My new site, although small, makes extensive use of Craft’s Matrix. I’ve learned a lot and I’m really pleased with it.

I’ve started to install the new site (alongside the old one) and I’ve discovered that Fasthosts shared hosting doesn’t allow the new index.php file to be located inside a ‘public’ sub-folder – it has to be at the root of the htdocs folder. So my first option seems to be to empty the contents of my ‘public’ folder into my htdocs folder, to live alongside the craft folder.

There are stern, but mysterious, warnings about doing this in Craft’s installation documentation: "We recommend that you upload the folder above your web root if possible, which will ensure that no one can access any of its files directly. (Your web root is the folder that your domain name points to.) That’s not a requirement, but do it if you can. For the children.”

Could someone please explain what bad things might happen if I take this first option?

I did a bit of research before I posted this question, and I came across a second option to leave everything in the public folder and to use mod\_rewrite code in the .htaccess file to re-route requests for index.php into the public folder.

Lastly, I found a third option of creating an extra index.php file located in the htdocs folder to point to index.php the public folder, with this re-direction code:

`php
header('Location: http://mydomain.com/public');
exit;
?`

Which of these three options is the best compromise from a security / SEO / performance perspective?

**Tags:** install, htaccess


---

## 2 answers

### Answer by username_1 on 2015-05-26. Score: 1 | Accepted answer

As André mentioend, everything inside your `public` folder should go inside FastHosts' `htdocs` folder. Public is just what Craft says should go in your publicly accessible web "root".

On most hosts I've seen, you should be able to put the Craft folder on the same level where `htdocs` lives. Generally I've found shared hosting to look like this:

`/yourhomefolder/domain.com/htdocs/index.php`

If you have an htdocs folder, everything inside what's in your `public` folder will go in there and the `craft` folder will go inside your domain.com folder, up one level.

If the host is running something like cpanel, you can usually change which folder your website domain's root is going to be. In that case, just keep your public folder, and then point the domain's "root" to be that folder, instead of htdocs:

`/yourhomefolder/domain.com/htdocs/public/index.php`

If you don't have a control panel option, sometimes contacting support and asking them if that's possible can help.


---

### Answer by username_2 on 2015-05-24. Score: 5

It's not so much that you can't have the index.php file in a subfolder that might be an issue; it is that you can't put the craft folder above your webroot. If you have access to the folder that htdocs is inside, you should try putting the craft folder inside that. It might not be obvious, but there's no reason that the public folder has to be named public. It could be html, htdocs, or whatever. The point is that you're suppose to put the craft folder above this folder.
On many "simple" webhosts, you may not be allowed to do this, and you have to put the craft folder within your public folder. The security risk involved with doing this is, as the warning states, related to your craft folder being directly accessible through a webbrowser. For instance, you're db.php config file would now be "accessible" by going to http://yourdomain.com/craft/config/db.php. As long as your webserver is configured correctly, and there are no security holes to exploit, this doesn't really matter, since the file will be processed as php, and doesn't output anything. 
But, in theory, if a malicious user manages to, for instance, crash the php process, he'd see the file as pure text. Or, if he's able to initiate a download of a file inside your public root, he'd be able to get to all your configuration files. But, then again, you might have problems even if the craft folder is outside of your public root.
If you can't put craft outside your public root folder, options 2) and 3) doesn't really help, they just introduce more problems. Just put the files in your public folder, and the craft folder, inside your htdocs folder, and reconfigure the path to craft in index.php to:
$craftPath = './craft';

Then, make sure that inside your craft folder the .htaccess file that comes with Craft is still there. It's suppose to say:
deny from all

This should, under normal circumstances, deny direct access to the craft folder.


---

