I’ve got a small, low traffic site that I’ve rewritten with Craft and a Bootstrap responsive grid, mainly as a learning exercise. The original site has just a dozen static pages, and is hosted with Fasthosts UK-based shared hosting. My new site, although small, makes extensive use of Craft’s Matrix. I’ve learned a lot and I’m really pleased with it.
I’ve started to install the new site (alongside the old one) and I’ve discovered that Fasthosts shared hosting doesn’t allow the new index.php file to be located inside a ‘public’ sub-folder – it has to be at the root of the htdocs folder. So my first option seems to be to empty the contents of my ‘public’ folder into my htdocs folder, to live alongside the craft folder.
There are stern, but mysterious, warnings about doing this in Craft’s installation documentation: "We recommend that you upload the folder above your web root if possible, which will ensure that no one can access any of its files directly. (Your web root is the folder that your domain name points to.) That’s not a requirement, but do it if you can. For the children.”
Could someone please explain what bad things might happen if I take this first option?
I did a bit of research before I posted this question, and I came across a second option to leave everything in the public folder and to use mod_rewrite code in the .htaccess file to re-route requests for index.php into the public folder.
Lastly, I found a third option of creating an extra index.php file located in the htdocs folder to point to index.php the public folder, with this re-direction code:
Which of these three options is the best compromise from a security / SEO / performance perspective?