What is best practice for protecting templates saved as files?

Question

I've just discovered that all of the templates I'm saving to the filesystem are accessible through the browser if the name is known, and now I've got a case of the screamin' heebie jeebies. For example, if I have a template-group/template arrangement such that the URL http://mysite.tld/news/recent delivers content, then when I point my browser at http://mysite.tld/templates/default_site/news.group/recent.html I'm then presented with all my raw template code. Is this expected behaviour and if so why? Is there a native EE way to stop this from happening, or is it best practice to use rewrite rules at the web server?

I'd really like to hear from some of you on how you've dealt with this problem in your own sites.

Many thanks in advance,

Andy

Answer 1

It looks like you moved your templates folder to outside the system folder. Since you already did it, why not move it to above the web root?

Just remember to update the related settings.
(see "Server path to site’s templates" at the bottom of the page)

To keep all system files above the web root is good practice.

Alternatively...

If for some reason you don't want to or can not move above web root, another solution is to put a .htaccess file in your templates directory with:

deny from all

This will prevent direct access to the templates at URLs like http://example.com/templates/default_site/news.group/index.html, but ExpressionEngine will still be able to load the template just fine at http://example.com/news