Consider putting public-facing files in a public folder instead of mixing with application files #935

Activity

1. thedod commented on Feb 18, 2026

   

   thedod

   on Feb 18, 2026

   More actions

   Specifically, database/database.sqlite shouldn't be accessible from web. It's true that you provide a .htaccess file that blocks access to it, but I'm using a shared nginx host that ignores .htaccess, and doesn't let me configure denial of web access to files in any other way.
2. dezfutak commented on Apr 7, 2026

   

   dezfutak

   on Apr 7, 2026

   Last edited by dezfutak

   More actions

   Specifically, database/database.sqlite shouldn't be accessible from web. It's true that you provide a .htaccess file that blocks access to it, but I'm using a shared nginx host that ignores .htaccess, and doesn't let me configure denial of web access to files in any other way.

   Workaraound - add the following to your existing domain.conf entry in /etc/nginx/sites-enabled/ :

   # Deny access to hidden files, except .well-known if you use it
       location ~ /\.(?!well-known/) {
           deny all;
           access_log off;
           log_not_found off;
       }
   
       # Deny access to sqlite and zip files
       location ~* \.(sqlite|zip)$ {
           deny all;
           access_log off;
           log_not_found off;
       }