Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I pay monthly for a website hosting service that provides me with PHP and FTP support. I can upload my files and create directories and such.

Now, I am wondering... If I upload a folder full of images.. or music.. basically personal stuff to my website and name it 'junk1234' can other people find it?

Or even search engines?

If so, How would I restrict any but those who know the folder name from seeing files in it? Possibly httaccess files?

I also have cpanel installed.

share|improve this question
up vote 2 down vote accepted

If the URL is unique enough it is unlikely that a random person will find it but why not add a username and password for added security?

You could add something like this to your .htaccess file to require authentication by a particular user on the system:

AuthType Basic
AuthName "Authorization Required"
AuthUserFile /var/www/passwords
Require User tom

To create the authentication file /var/www/passwords with user tom in it:

htpasswd -c /var/www/passwords tom

(related link)

Here is a related link that claims that unsecured "secret" directories will most likely remain private as long as know one that knows about them publishes their location.

share|improve this answer
Just a thought when considering search engines, there are "evil" bots that specifically look inside robots.txt for places that are hidden in this manner. For personal files, it is really best to just not advertise they exist, and change the directory name periodically. – Goyuix May 10 '10 at 16:18
So a random directory cannot be found without knowing the name? like there is no html command or server command they can send to list directories? – tcables May 10 '10 at 16:29
@Tom: Commands like these exist, but none through HTML or HTTP. If anybody gets FTP or SSH access to your server, then they could find the files, but they're fairly secure protocols, so they're only getting passwords if you give them out. – Phoshi May 10 '10 at 16:32
@Gouyuix: You're right. Bots or humans could very easily find the hidden directory by adding them to your robots.txt file. I'll take back that suggestion for security's sake. – Trey Hunner May 10 '10 at 16:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .