Is it a security risk to put Craft templates inside public root?

Question

Due to the way our build and deployment process works, it's convenient for us to have the Craft templates inside our /public/assets folder together with our css and javascript, instead of in /craft. Does this make the site less secure than having them outside of the public root?

Answer 1

If you’re running Apache, you can put a .htaccess file in your templates/ folder with this in it:

Deny from all

and any HTTP traffic to that folder will be given an Apache 403 error.

Even better, you can put this in there:

# Send the request to Craft
RewriteEngine On
RewriteRule (.*) /index.php?p=$1 [QSA,L]

and the request will be redirected to Craft’s index.php file behind the scenes, the same way that would-be 404s are sent there. So even if you go to /templates/index.html, or any other URL that points to an actual file within your templates/ folder, it will end up as /index.php?p=templates/index.html, leaving Craft to handle the request, which will most likely result in a Craft-based 404.

Answer 2

It depends on what kind of secure infos you write into your templates. I wouldn't put my credit card infos into a twig comment for example, if the template is not above the root.

But normally all one could make up from the raw template code is rather uninteresting and not really relevant for further hacking attempts, I'd say.

Note: please do NOT put the craft/config/ folder above the root!