Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've recently setup a new virtual server to host my websites. I'm pretty new to Linux based systems and sysadmin stuff and as a result have a few questions with regards to file and directory permissions.

My main site is located in /var/www and in there I have a directory where I keep a few PHP scripts, one of which contains the connection details to the database. What I'm looking to do is ensure that nobody has access to these scripts by visiting but are still accessible to the www-data user so they can actually be called and executed from other pages on the site.

My initial thought is to change the permissions on the files to 400; however, I don't know what to do with regards to the permissions of the directory.

How do I change the permissions on the directory so that the files within it can be executed but not seen by people when they visit

share|improve this question
up vote 1 down vote accepted

You can fix this via apache configuration. See

Using a

<Directory /mydir>
    Order deny,allow
    Deny from all

, outside access to the directory is blocked, but php-scripts are still allowed to access it.

share|improve this answer
Thank you etagenkio. That's exactly what I was looking for. – Martyn Apr 3 '13 at 21:14

A correctly configured Apache/PHP stack will not allow the .php file containing your database details to be output to the browser, because it will be interpreting it as a .php script and not text. So if someone stumbles on that directory or file, they will not see the database login -- again, provided Apache is configured correctly and there are no errors in your script.

However, it is good practice to place scripts in a different directory from the public-facing directory, one that is not served directly by Apache. Many helpful answers are available on Stackoverflow with some searching, here's one:


And another.

Also if you're really serious about learning PHP I'd check out some frameworks to learn WHILE you're learning the language, which help handle some of this stuff for you and also provide security in areas you didn't know you needed it. PHP isn't an inherently insecure language but it is very easy to write an insecure application.

share|improve this answer
Thanks for your advice and the links. – Martyn Apr 3 '13 at 21:33

if you have a index.php it wont matter if they do go to /var/www/mydir because it will only display what is in the index.php..

share|improve this answer
They can not list the directory, but they could still guess random names and try t get the file. This would not do what the OQ intended. – Rich Homolka Apr 3 '13 at 22:14
true, i guess ive never worried about it! – dashboard Apr 3 '13 at 23:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .