Security question

[Music Man]

In the ZC site security recommendations I saw the following:

"/cache
..... The BEST security protection for this is to move it to a folder "above" the webroot (public_html or htdocs or www) area, so that it's not accessible via a browser. (Requires changes to DIR_FS_SQL_CACHE setting in configure.php files as well as Admin > Configuration > Sessions > Session Directory.)"

I ran this by my host and got the following response....

"You can move that folder to your home directory (the folder in which public_html lives). You wouldn't have an address(URL) for that directory once moved out of your web root, but you would have a filesystem path......... "

Two questions come to mind:

1. By doing what the host says am I placing /cache folder on the same level or "above" the webroot? It sounds like I'm "above" but just wanted to check my understanding with someone else who is familiar with ZC.....

2. How many configure.php files need changing?

Thanks for looking.....

MM

[DrByte]

1. Yes.
2. Two

[Music Man]

Yes to "above" or same level in question #1?

Thanks

MM

[DrByte]

Your server probably has the following folder structure:

/home/username/public_html

The "webroot" in that example is the "public_html" part.

So, if you move your cache folder to /home/username/cache then that puts the cache folder outside the webroot. Whether you want to be semantic and call it 'above' or 'beside' doesn't matter. In the "industry" being "outside" the webroot is also affectionately called "above" the webroot too.

[Music Man]

Ahh...I think I've got it now....

Thanks for the help...

MM