I'm pretty new to running my own websites, and wanted to know how to protect directories/files from malicious users. I'm mostly concerned with protecting PHP files.
For example, my website has a PHP file that sends email to me from a contact form, and that PHP file has my email username and password in it (using PHPMailer). I've placed the file inside my
/html directory along with
/PHPMailer. Do I have to worry about other people being able to see it? Is it normal to have PHP scripts out in the
/html (public) directory?
I've also thought about setting my permissions for PHP files to 711, so that they will execute to everyone but no one will be able to read or write to the files. Am I going about this in the right way?
If someone could point in a good direction I would really appreciate it, kinda paranoid about this