How do I install Craft in shared hosting that doesn't allow index.php in a sub-folder

Question

I’ve got a small, low traffic site that I’ve rewritten with Craft and a Bootstrap responsive grid, mainly as a learning exercise. The original site has just a dozen static pages, and is hosted with Fasthosts UK-based shared hosting. My new site, although small, makes extensive use of Craft’s Matrix. I’ve learned a lot and I’m really pleased with it.

I’ve started to install the new site (alongside the old one) and I’ve discovered that Fasthosts shared hosting doesn’t allow the new index.php file to be located inside a ‘public’ sub-folder – it has to be at the root of the htdocs folder. So my first option seems to be to empty the contents of my ‘public’ folder into my htdocs folder, to live alongside the craft folder.

There are stern, but mysterious, warnings about doing this in Craft’s installation documentation: "We recommend that you upload the folder above your web root if possible, which will ensure that no one can access any of its files directly. (Your web root is the folder that your domain name points to.) That’s not a requirement, but do it if you can. For the children.”

Could someone please explain what bad things might happen if I take this first option?

I did a bit of research before I posted this question, and I came across a second option to leave everything in the public folder and to use mod_rewrite code in the .htaccess file to re-route requests for index.php into the public folder.

Lastly, I found a third option of creating an extra index.php file located in the htdocs folder to point to index.php the public folder, with this re-direction code:

<?php header('Location: http://mydomain.com/public'); exit; ?>

Which of these three options is the best compromise from a security / SEO / performance perspective?

Answer 1

As André mentioend, everything inside your public folder should go inside FastHosts' htdocs folder. Public is just what Craft says should go in your publicly accessible web "root".

On most hosts I've seen, you should be able to put the Craft folder on the same level where htdocs lives. Generally I've found shared hosting to look like this:

/yourhomefolder/domain.com/htdocs/index.php

If you have an htdocs folder, everything inside what's in your public folder will go in there and the craft folder will go inside your domain.com folder, up one level.

If the host is running something like cpanel, you can usually change which folder your website domain's root is going to be. In that case, just keep your public folder, and then point the domain's "root" to be that folder, instead of htdocs:

/yourhomefolder/domain.com/htdocs/public/index.php

If you don't have a control panel option, sometimes contacting support and asking them if that's possible can help.

Answer 2

It's not so much that you can't have the index.php file in a subfolder that might be an issue; it is that you can't put the craft folder above your webroot. If you have access to the folder that htdocs is inside, you should try putting the craft folder inside that. It might not be obvious, but there's no reason that the public folder has to be named public. It could be html, htdocs, or whatever. The point is that you're suppose to put the craft folder above this folder.

On many "simple" webhosts, you may not be allowed to do this, and you have to put the craft folder within your public folder. The security risk involved with doing this is, as the warning states, related to your craft folder being directly accessible through a webbrowser. For instance, you're db.php config file would now be "accessible" by going to http://yourdomain.com/craft/config/db.php. As long as your webserver is configured correctly, and there are no security holes to exploit, this doesn't really matter, since the file will be processed as php, and doesn't output anything.

But, in theory, if a malicious user manages to, for instance, crash the php process, he'd see the file as pure text. Or, if he's able to initiate a download of a file inside your public root, he'd be able to get to all your configuration files. But, then again, you might have problems even if the craft folder is outside of your public root.

If you can't put craft outside your public root folder, options 2) and 3) doesn't really help, they just introduce more problems. Just put the files in your public folder, and the craft folder, inside your htdocs folder, and reconfigure the path to craft in index.php to:

$craftPath = './craft';

Then, make sure that inside your craft folder the .htaccess file that comes with Craft is still there. It's suppose to say:

deny from all

This should, under normal circumstances, deny direct access to the craft folder.