Let's say I create a website (with apache for example) and my php pages get some sensitive information from a file on disk (a .ini file, a SQLite db or whatever).

I thought two ways to prevent users from getting to this information:

  • separate document folder (/var/www/html) and data folder (/var/www/data) where to put these sensitive files

  • put sensitive files inside the document root folder (/var/www/html) and prevent them access with .htaccess files

Is there a noticeable security risk with using one method or another? Or are they equivalent?

2 Answers 2


I think that by including it in the webroot, you may leave yourself vulnerable to some bypass if you do not write the .htaccess correctly.

If you keep important files outside the webroot in a directory such as /opt or /etc/web_program_folder/data, there's no way they will be able to access that data without a local file inclusion vulnerability as apache or nginx (whatever you're using to serve the application) will not allow them to traverse up into the /opt, /etc directories.

  • Agreed, .htaccess seems like a legacy method and is more prone to mistakes. Aug 4, 2019 at 12:46

Putting the file into a folder into your document root folder may not present a direct risk (as long as you have your permissions properly set), however in case of an attack which comes locally, i.e. LFI, this means the attacker would be able to either abuse your script locally and read sensitive information regardless of any ACL placed, or write to a file which is executable on the server using a server-side scripting language like php or asp.

Imagine the following scenario:

You have a folder for storing sensitive data in your document root, /var/www/html/sensitivedata and at the same time you have restricted access to this folder using an .htaccess file

index.php is prone to Local file inclusion using the following approach: index.php?p=filename (even if you use specific extensions there are ways to bypass this, but this is out of scope)

Then an attacker would be able to read your file by accessing the following url: http://domain.com/index.php?p=sensitivedata/filename.txt

Of course, the same thing could happen if the directory 'sensitivedata' is outside of the document root, however exposing it publicly defines an additional attack vector, as it is clear to the attacker that the directory exists.

A question that may arise is how would an attacker know that filename.txt exists? This can be done either by bruteforcing or by enumerating the filesystem using any other means the attacker may have found.

In case the attacker found a way to write files to the system, he could write an executable script to /var/www/html/sensitivedata/randomscript.php and then execute it by just visiting https://domain/sensitivedata/randomscript.php which would give provide him with local access to the system and the ability to execute commands, called RCE or Remote Command Execution.

Now having in mind the above scenario, in case your folder is outside of your document root, the attacker wouldn't be able to execute the script he uploaded.

An ACL using htaccess wouldn't present a vulnerability itself, but raises a risk in case the attacker found a way to access the filesystem using a vulnerable web script or by any other means.

Any sensitive data or a folder used as a container to store files, especially when they are being uploaded by the user should be outside of document root and handled with caution. If you need to provide any authenticated users access to read them you should implement a script handling the process instead of providing them with a direct access to your folder/file.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .