I'm new to linux and want to host a website on dedicated server, I put the php files in the public "www" directory along with private folder that should be accessed only by the server itself (I mean php scripts writing and reading files in the folder). I read that the Apache server operates under account "www-data", so I set that account as folder owner with permissions 700, but I can still access this folder from web browser at home, until I remove the www-data permissions. Is it normal that the website visitors use the same account as web server? If so, how can I configure the permissions correctly so only PHP script can access the files within dir?

Here's the test file and it's permissions

-rwx------ 1 www-data www-data 4 sie  9 08:28 test.txt

Best regards


Because Apache uses the www-data user, anything that can be accessed by www-data (and is in the web root directory) can be accessed by anyone connecting to your server with a web browser. Think of it as if the visitors to your site ARE the www-data user.

The easiest way to fix the issue you are having is to simply move the files you want only PHP to access outside the web root directory. For example, let's say your web root is "/var/www/", and you want to put your files in "/data". Put your PHP script in the "/var/www/" directory, then access the files in the script using absolute names:

// Load the contents of the file at "/data/test.txt" into the $data variable.
$data = file_get_contents("/data/test.txt");

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.