My understanding is that you should never host your configuration.php file within the public_html directory (I am specifically referring to Joomla, but I imagine this is a cross-platform scenario).

My question is: is it at all possible for a user to access/view this configuration file over the internet, or would they first have to exploit the server and then use that exploit to access the config file. In other words, is the best-practice of keeping configuration.php outside of the web root purely to stop a minor exploit from escalating higher, or does the file's existence provide a vulnerability in and of itself?


A configuration file is not publicly viewable over the internet as long as the permissions are setup correctly. Configuration files usually do not output any data directly anyway.

They are able to download a copy of the configuration file if they exploit your server and gain access via methods such as SSH, FTP or through a web-based control panel.

Keeping the configuration.php file outside of the web root directory does increase the level of security, however if an attacker was to compromise your server and gain full access then they are still able to access this file.

  • 1
    It's not really a permissions issue - unless you run your CGI / fastCGI under a differnt uid than the webserver - the issue arises when the webserver fails to filter php files through the PHP engine, either via direct access or LFI. Keeping configuration files / authentication tokens outside the document is good practice but it's not a panacea. – symcbean Oct 2 '12 at 10:54

With a normal web server configuration (at least in most web hosting companies), any PHP files cannot be access directly by visitors over the Internet. All they get are the one that interpreted in HTML. This also meant as well for configuration.php (or config.php) for any web apps.


For a stronger security of configuration PHP files you can also lock file for preventing of changing or manipulating them. This will add stronger security.

On a linux server function are chattr and on a VPS server you should lock a file of configurations:

chattr +i /home/user/configuration.ini

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.