What's the general consensus regarding the renaming of the system directory if it resides above root? I was recently updating my default EE install to initially start with the directory above root and thought that it was overkill. It seems to me that if someone discovers the system directory when it's above root you have much bigger problems to worry about. Is renaming the system directory overkill or should I rename both the admin.php file AND the system directory?
Add a comment
|
3 Answers
We setup a folder called "private_ee" (to compliment "public_html") above the web root which contains directories for snippets, system, templates, and third_party. As you said, if someone gets access above the web root, you've got bigger problems.
In other words, there's no need to rename it for security's sake; the security advantage you obtain is gained by moving it above the web root, not by obscuring the path.
-
1I like this approach, especially since I've also started making some other folders above root for config.php and related config files and all my archives from backup proish and updater. Commented Dec 5, 2012 at 14:48
It doesn't hurt to do both and takes literally five minutes.
If you started out like probably most people with the system directory below root, you probably already have an alternate name convention. Rather stick to it.
answered Nov 27, 2012 at 21:04
Renaming the system directory if it's located above your web root makes absolutely no difference in terms of security or anything else. If someone gains access to your server above web root, you're pooched regardless.
answered Nov 27, 2012 at 21:06
-
Is that a reason not to rename it? By following a convention at least if the server configuration ever changes, you're a little safer. Hackers often have to work blind, so I think it's better to obfuscate wherever possible and within the bounds of reason! Commented Nov 27, 2012 at 21:25