Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I pay monthly for a website hosting service that provides me with PHP and FTP support. I can upload my files and create directories and such.

Now, I am wondering... If I upload a folder full of images.. or music.. basically personal stuff to my website and name it 'junk1234' can other people find it?

Or even search engines?

If so, How would I restrict any but those who know the folder name from seeing files in it? Possibly httaccess files?

I also have cpanel installed.

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

If the URL is unique enough it is unlikely that a random person will find it but why not add a username and password for added security?

You could add something like this to your .htaccess file to require authentication by a particular user on the system:

AuthType Basic
AuthName "Authorization Required"
AuthUserFile /var/www/passwords
Require User tom

To create the authentication file /var/www/passwords with user tom in it:

htpasswd -c /var/www/passwords tom

(related link)

Here is a related link that claims that unsecured "secret" directories will most likely remain private as long as know one that knows about them publishes their location.

share|improve this answer
1  
Just a thought when considering search engines, there are "evil" bots that specifically look inside robots.txt for places that are hidden in this manner. For personal files, it is really best to just not advertise they exist, and change the directory name periodically. –  Goyuix May 10 '10 at 16:18
    
So a random directory cannot be found without knowing the name? like there is no html command or server command they can send to list directories? –  tcables May 10 '10 at 16:29
    
@Tom: Commands like these exist, but none through HTML or HTTP. If anybody gets FTP or SSH access to your server, then they could find the files, but they're fairly secure protocols, so they're only getting passwords if you give them out. –  Phoshi May 10 '10 at 16:32
    
@Gouyuix: You're right. Bots or humans could very easily find the hidden directory by adding them to your robots.txt file. I'll take back that suggestion for security's sake. –  Trey Hunner May 10 '10 at 16:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.