I've just discovered that all of the templates I'm saving to the filesystem are accessible through the browser if the name is known, and now I've got a case of the screamin' heebie jeebies. For example, if I have a template-group/template arrangement such that the URL http://mysite.tld/news/recent delivers content, then when I point my browser at http://mysite.tld/templates/default_site/news.group/recent.html I'm then presented with all my raw template code. Is this expected behaviour and if so why? Is there a native EE way to stop this from happening, or is it best practice to use rewrite rules at the web server?

I'd really like to hear from some of you on how you've dealt with this problem in your own sites.

Many thanks in advance,


1 Answer 1


It looks like you moved your templates folder to outside the system folder. Since you already did it, why not move it to above the web root?

Just remember to update the related settings.
(see "Server path to site’s templates" at the bottom of the page)

To keep all system files above the web root is good practice.


If for some reason you don't want to or can not move above web root, another solution is to put a .htaccess file in your templates directory with:

deny from all

This will prevent direct access to the templates at URLs like http://example.com/templates/default_site/news.group/index.html, but ExpressionEngine will still be able to load the template just fine at http://example.com/news

  • Yes, of course, thank you, Robson. As soon as I began to read your answer it clicked. I've been dealing with this one particular deployment for so long (and to the exclusion of all others) that I had completely lost track of the fact that the template folder is normally in the system folder. Big mea culpa on this one.
    – Andy
    Jun 27, 2014 at 10:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.