joomla in root or not?

Kezz

Free Member
Nov 21, 2008
22
5
Stoke-on-Trent
Hi,

I'm setting up an ecommerce shop using joomla, and I've stumbled at the first block. Do I want Joomla in the root directory or in another directory? What's the difference? :|

I've had a google around and I can't figure it out myself so I figured I'd ask the experts. Can any explanations be translated into joomla/directories for idiots style instructions?

Thanks in advance
:|
 

FireFleur

Free Member
Oct 29, 2008
1,881
440
Generic locations would be:

/mnt/project-name/
/srv/project-name/

/var/project-name/

If you pop it in the root (/), which you can do, you can get a name clash with a system directory but it would be rare.

Often the directory chosen will be related to a partition as well.

Be aware that root can also mean joomla root, it is rare to install to /
 
Upvote 0

ORDERED WEB

Free Member
Jun 30, 2009
1,650
394
Cyprus / LONDON
Hi,

I'm setting up an ecommerce shop using joomla, and I've stumbled at the first block. Do I want Joomla in the root directory or in another directory? What's the difference? :|

I've had a google around and I can't figure it out myself so I figured I'd ask the experts. Can any explanations be translated into joomla/directories for idiots style instructions?

Thanks in advance
:|

If you dont intend to do anything else major with the webspace - put it in the root. What ever you do now, adding / editing the re-write rules in a .htaccess file can resolve issues down the line, so dont worry about it, install it in the front of the domain (unless you have another package with a index.php file allready in the root, that you cant move
 
Upvote 0

KM-Tiger

Free Member
Aug 10, 2003
10,346
1
2,893
Bexley, Kent
One reason for not putting it in the root of your webspace would be if you want visitors to see something else while you develop your Joomla site, or if you want to change it later.

Joomla won't care, as long as you can direct your webserver to serve Joomla's index.php when visitors go to your site.
 
Upvote 0

FireFleur

Free Member
Oct 29, 2008
1,881
440
Well root is not really advised:

http://www.pathname.com/fhs/

There is the FHS, the real issue is partitioning, normally you would keep root small.

.htaccess is also not advised

http://httpd.apache.org/docs/1.3/howto/htaccess.html

Installing to a web server root, can be problematic if any passwords or sensitive data is stored in the PHP or any file there; if the webserver subsequently gets misconfigured it can fail open and display all the code as text, including your passwords.
 
Last edited:
Upvote 0

edmondscommerce

Free Member
Nov 11, 2008
3,653
628
UK
good points re security etc, however i think your joomla install is going to be in a web accessible directory regardless, the question is if its in the web root or a subdirectory of the webroot.

I would say go for the webroot every time.

Re the security issues, you can use some include files and put those outside the webroot for your passwords, but this isn't likely to be a standard feature. Not too hard to do though if you know what you are doing
 
Upvote 0

FireFleur

Free Member
Oct 29, 2008
1,881
440
I haven't looked at Joomla, but if that is a standard install that is a little worrying.

In fact if you use Joomla you should mention it on their forums, it is pretty well known as a security hole. They should install in and outside of the web daemon root, ( I used daemon rather than server there so people don't think it is the web server's file system root). Identifying the sensitive data and keeping that outside.

Or do a virtual directory inside of the install mapped to a joomla directory outside of docs:

/srv/httpd/docs/ -> /srv/httpd/joomla/web/

/srv/httpd/joomla/web/
/srv/httpd/joomla/config/
 
Last edited:
Upvote 0
I wouldn't worry too much about FireFleur's response, Kezz - that's specific to someone having total control over their webserver setup etc.

The simple basis for your question is this :
Will you be using Joomla to manage the content of your entire site, or just one section?

If it's managing the entire site, put it in the main root of the site.
If it's only managing one section, put it in that section.

So in your case, if Joomla is only being used to manage the shop side of things, then I'd install it in /shop (or whatever the folder is).
If you want to update your entire site to be Joomla run, put it in the main directory.
 
Upvote 0
Yes, but the shared host is less likely to have a webserver suddenly get "misconfigured" so it parses .php files as .txt and thus displays them with passwords or whatever.

With Joomla (which you admit to not having used) being open-source and popular, and having been in existence for *cough* years (first as Mambo, then as Joomla) there are thousands (if not tens-of-thousands) of sites using it. Installing a web-based CMS outside the webroot is - at best - impractical, and generally makes it unusable.

However, this has gone out of the topic of the original question.

The response to the original question is the same one I put earlier on this :

If you're using Joomla to manage the entire site, put it in the root (i.e. www.site.com/ )
If you're only using it for the shop (or whatever section) put it in that section.
 
Upvote 0

FireFleur

Free Member
Oct 29, 2008
1,881
440
A shared server is far more likely to fail open than a dedicated.

Yes, whilst I may not have used Joomla I have used Apache going on for well over a decade, and PHP since the early days as well.

It is a security risk there is no getting away from it, what matters is the importance of the project, if it is of low importance then whatever, but if the site has to work then if Joomla doesn't have workarounds for this then avoid Joomla.
 
Last edited:
Upvote 0
I've created and installed several Joomla sites and always installed it into the web root (which is it's default).

Whilst, as mentioned there is the potential that if the server gets misconfigured it could display file listings, all the Joomla files are PHP (including the configuration files) and commence with a 'JEXEC or DIE' statement that prevents them being called and displayed directly - i.e. they have to be called in the correct context otherwise they, well die........ So the security issue mentioned is catered by standard.

So unless there is a burning need not to install it in the web root, then that's where I would place it.

Hope this helps.
 
Upvote 0

FireFleur

Free Member
Oct 29, 2008
1,881
440
The DIE has to be interpreted by something.

If PHP is removed from the server, then the files all get delivered as text, it is not a defence for the server being misconfigured, as the big misconfiguration is PHP itself failing and being removed.

It maybe a defence on a shared from other users trying to view source files of someone else's files on the server, that makes more sense, and then it really only stops an include from outside. And if they can include it, they can open it.
 
Last edited:
Upvote 0
Surely this applies to any system (Wordpress/Drupal etc.) though and is not an issue with Joomla per se? Joomla tells you how the server should be configured.

It's like having the best locks on your doors, then forgetting to actually close the door?

:D
 
Upvote 0

FireFleur

Free Member
Oct 29, 2008
1,881
440
Well it depends how you get the configuration information in, but yes this is a common security problem.

It is more a problem for the PHP, ASP, Coldfusion lot because they tend to create a file per URL (they don't have to but most do).

Instead you should move the config, definitely username and password for database outside of the DocumentRoot. And then include it from there, it normally still has to be in a place accessible by the application or web server.

It is quite a small thing to do, and is trivial to implement, so I would be surprised this hasn't been done by Joomla in some way.
 
Upvote 0

edmondscommerce

Free Member
Nov 11, 2008
3,653
628
UK
I think the reason most open source apps install entirely to teh webroot is that with so many different server configs etc its the only way they can be sure that it will install on most servers.

If you know what you are doing you can separate out the sensitive stuff to a non web root folder.

I'm not too worried if the general source code is exposed - after all it is open source :)

If your shared hosting server starts spitting out PHP files as text files I would quickly look to moving to a new host.

If you are concerned about security then look to host on a dedicated or virtual dedicated server.

To conclude, I would recommend as Ozbon says - if Joomla is going to be the whole site (I imagine it is) then intall it to the web root.

As said this is all a bit off topic for the OP.

As said by Ozbon - if its for the whole site (presumably it is) then install it to the web root.
 
Last edited:
Upvote 0

FireFleur

Free Member
Oct 29, 2008
1,881
440
Well shared may or may not be setup with security in mind.

A lot of ISPs seem to leave most of them pretty open.

So, if the project is important don't used share unless they offer some explanation of how they secure in a shared environment.

Joomla forums will probably have the solution for keeping sensitive information secure as I mentioned before.

But, it does boil down to how important the project is, if you keep daily backups and can afford to lose 24 hours of data, and hold no sensitive data on any third party does it matter?
 
Upvote 0

KM-Tiger

Free Member
Aug 10, 2003
10,346
1
2,893
Bexley, Kent
Upvote 0

FireFleur

Free Member
Oct 29, 2008
1,881
440
If it is ecommerce and you are going to hold details of other people, then you have to secure up, and shared is often not the way.

If you hold credit card details, then there are extra rules as well so try to avoid doing that.

I would advise you build your site locally, and at the same time keep your eyes open for a good dedicated deal or perhaps a Virtual Server which will afford a bit more security.

Make the decision when you have the first iteration of the site done.
 
Upvote 0

KM-Tiger

Free Member
Aug 10, 2003
10,346
1
2,893
Bexley, Kent
If you are going to be experimenting, then you might do well to put Joomla in a sub-directory while you work on it, and leave a holding page in the root which Google can index.

Swap over when you are ready, and if you are really paranoid .htaccess the subdirectory so that only you can see it.
 
Upvote 0

asonda

Free Member
Jan 28, 2007
3,653
301
Cornwall
Looks like you are well on the way.

All the Joomla site's I have ever done, it has always been put into the Root Directory.

If you are saving data, such as credit details etc, as mentioned before there are rules for that and you would need to look into the more advanced stuff.

One thing to mention, is once you have it all running, make sure you check back to the Joomla website and update your Joomla version whenever an update has become available, they are usually security updates.

Templates, if you use a template (as making one from scratch for a newbie, is a very long task) make sure you use one from a trusted source. Don't be tempted to shirk the £20 or however much they are and donwload an illegal copy, as some have been known to have extra code!
 
Upvote 0

Latest Articles