6

What's the general consensus regarding the renaming of the system directory if it resides above root? I was recently updating my default EE install to initially start with the directory above root and thought that it was overkill. It seems to me that if someone discovers the system directory when it's above root you have much bigger problems to worry about. Is renaming the system directory overkill or should I rename both the admin.php file AND the system directory?

7

We setup a folder called "private_ee" (to compliment "public_html") above the web root which contains directories for snippets, system, templates, and third_party. As you said, if someone gets access above the web root, you've got bigger problems.

In other words, there's no need to rename it for security's sake; the security advantage you obtain is gained by moving it above the web root, not by obscuring the path.

  • 1
    I like this approach, especially since I've also started making some other folders above root for config.php and related config files and all my archives from backup proish and updater. – Stuart McCoy Dec 5 '12 at 14:48
2

It doesn't hurt to do both and takes literally five minutes.

If you started out like probably most people with the system directory below root, you probably already have an alternate name convention. Rather stick to it.

0

Renaming the system directory if it's located above your web root makes absolutely no difference in terms of security or anything else. If someone gains access to your server above web root, you're pooched regardless.

  • Is that a reason not to rename it? By following a convention at least if the server configuration ever changes, you're a little safer. Hackers often have to work blind, so I think it's better to obfuscate wherever possible and within the bounds of reason! – Richard Frank Nov 27 '12 at 21:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.