I'm pretty new to running my own websites, and wanted to know how to protect directories/files from malicious users. I'm mostly concerned with protecting PHP files.

For example, my website has a PHP file that sends email to me from a contact form, and that PHP file has my email username and password in it (using PHPMailer). I've placed the file inside my /html directory along with /PHPMailer. Do I have to worry about other people being able to see it? Is it normal to have PHP scripts out in the /html (public) directory?

I've also thought about setting my permissions for PHP files to 711, so that they will execute to everyone but no one will be able to read or write to the files. Am I going about this in the right way?

If someone could point in a good direction I would really appreciate it, kinda paranoid about this

  1. It is normal to have PHP scripts in the public directory.
  2. Setting the permissions to 711 is a good way.
  3. Using .htaccess to set permissions for PHP files is a good idea. You can see a detailed tutorial here - http://httpd.apache.org/docs/2.2/howto/htaccess.html

It shall help you in other places as well like redirection etc. And staying at your point for security, it will surely work.

And as you said that a PHP file has your email address and password, its Ok.

Edit: New link to set file permissions : http://www.htaccess-guide.com/preventing-access-to-your-php-includes-files/

| improve this answer | |
  • but won't people be able to see the contents of my php files? thanks for your reply – a7omiton Feb 12 '14 at 9:53
  • No, the script will execute, and will only output what is echoed by the scripts. To explain this, let me go in detail. PHP is a server side script. So it executes on the owners server and not on the user's computer. Then, it sends data to the user and the data sent is the only thing visible to the user, not the entire script. Even if the user views the source of the php file, he will see plain html auto-formated by the PHP engine and sent to the user. – user3459110 Feb 12 '14 at 10:08
  • ok thank you for your help! you mentioned setting permissions via htaccess, do you mean file permissions? i didn't know you could do that – a7omiton Feb 12 '14 at 10:24
  • Yup, I meant file permissions for PHP files. You could do that. And if you have access to the main server httpd configuration file, then you can do it with that as well. Both of them have there own pros and cons as described by the first link. For a more practical tutorial on .htaccess, check the new link I posted. – user3459110 Feb 12 '14 at 12:27
  • I can't thank you enough for the resources you've provided along with your reassurance. Much appreciated! – a7omiton Feb 12 '14 at 22:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.