I've recently setup a new virtual server to host my websites. I'm pretty new to Linux based systems and sysadmin stuff and as a result have a few questions with regards to file and directory permissions.

My main site is located in /var/www and in there I have a directory where I keep a few PHP scripts, one of which contains the connection details to the database. What I'm looking to do is ensure that nobody has access to these scripts by visiting www.mydomain.co.uk/mydir but are still accessible to the www-data user so they can actually be called and executed from other pages on the site.

My initial thought is to change the permissions on the files to 400; however, I don't know what to do with regards to the permissions of the directory.

How do I change the permissions on the directory so that the files within it can be executed but not seen by people when they visit www.mydomain.co.uk/mydir?


You can fix this via apache configuration. See http://httpd.apache.org/docs/2.2/howto/access.html

Using a

<Directory /mydir>
    Order deny,allow
    Deny from all

, outside access to the directory is blocked, but php-scripts are still allowed to access it.

  • Thank you etagenkio. That's exactly what I was looking for. – Martyn Apr 3 '13 at 21:14

A correctly configured Apache/PHP stack will not allow the .php file containing your database details to be output to the browser, because it will be interpreting it as a .php script and not text. So if someone stumbles on that directory or file, they will not see the database login -- again, provided Apache is configured correctly and there are no errors in your script.

However, it is good practice to place scripts in a different directory from the public-facing directory, one that is not served directly by Apache. Many helpful answers are available on Stackoverflow with some searching, here's one:



And another.


Also if you're really serious about learning PHP I'd check out some frameworks to learn WHILE you're learning the language, which help handle some of this stuff for you and also provide security in areas you didn't know you needed it. PHP isn't an inherently insecure language but it is very easy to write an insecure application.




if you have a index.php it wont matter if they do go to /var/www/mydir because it will only display what is in the index.php..

  • They can not list the directory, but they could still guess random names and try t get the file. This would not do what the OQ intended. – Rich Homolka Apr 3 '13 at 22:14
  • true, i guess ive never worried about it! – dashboard Apr 3 '13 at 23:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.