Where to place config.ini

Hosting Support
1

Hi,
I can’t find the place where to place my config.ini, which cointains database connection credentials. It is good practise to not place it in the public web directory, which is htdocs in my case. However, when I try to place it the root folder (where is the htdocs located too), it will get deleted.

2

@Admin?
I am not so sure but isn’t any code that disable access to it from other users?

3

Well, they have disabled access by default, but sometimes when webhost fails and begins serving PHP files as a text files, no one will get the database credentials as they will be outside the public web folder.

4

@JohnyX said:
Well, they have disabled access by default, but sometimes when webhost fails and begins serving PHP files as a text files, no one will get the database credentials as they will be outside the public web folder.

I mean when they are in he htdocs folder.

5

The htdocs folder is the public web folder isn’t it?

6

Yes?

7

Then leaving any files with credentials there could be dangerous IMO. Same for some PHP files.

8

@JohnyX said:
Then leaving any files with credentials there could be dangerous IMO. Same for some PHP files.

No, like WP_Config have Credentials in it but when we try to access it Reply with 520 HTTP Error so no problem if your coding is perfect!
I mean use if then else a perfect conditional statement
if Credentials found then show 403 Error else show configuration file

9

I request the config db credentials file like
require ("configuration.php");
and the file has 600 permissions. Is that correct? And it is located in the htdocs folder.

10

@JohnyX said:
I request the config db credentials file like
require ("configuration.php");
and the file has 600 permissions. Is that correct? And it is located in the htdocs folder.

You have to locate it within htdocs although you can create a subdirectory if you feel insecure like WHMCS do they install files at subdirectory that no one can visit it from WEB

11

@JohnyX

in whatever subdir you put your config.ini file (in htdocs)
you can prevent access from outside
if you put .htaccess file in that folder with this content

Deny from All

if you have mixed content in that subfolder
and you just want to prevent a certain extension
this code will prevent any access from outside for .ini files

<Files ~ "\\.ini$">  
Order Allow,Deny
Deny from All
</Files>
12

Thank you @OxyDac : I placed the htaccess inside that subfolder and blocked access to all files there.

1 Like
13

yw :slight_smile:

14

@OxyDac said:
@JohnyX

in whatever subdir you put your config.ini file (in htdocs)
you can prevent access from outside
if you put .htaccess file in that folder with this content

Deny from All

if you have mixed content in that subfolder
and you just want to prevent a certain extension
this code will prevent any access from outside for .ini files

<Files ~ "\\.ini$">  
Order Allow,Deny
Deny from All
</Files>

Thank you,I also learned something new,was sure that there was something he could do and you told it!

15