Moving Craft Files

In this guide, we’ll move Craft’s core files into the web root; a file structure that WordPress developers are familiar with. We advise against this practice in our guide, Securing Craft, but if you must, read on!

Craft’s file structure is similar to many modern web applications. You’ll find core application files, directories, and utilities in the project root alongside a web root directory which contains the index.php entry point. There are times when this file structure is not ideal. For example, some shared hosting plans give you FTP access to a single web root directory. This makes it difficult to put application files above the web root the way Craft expects.

Create a new app directory #

Create a new directory: /web/app

You might want to name it something more obscure for some security, but we’ll go with "app" here.

Protect the app folder #

If your web server is running Apache configured with AllowOverride All to allow .htaccess files to work, then create a new file, /web/app/.htaccess, and add this content:

order deny,allow
deny from all

If you’re running Nginx or aren’t able to use .htaccess files, then you’ll need to ask your web hosting provider how to protect that directory.

Move the core files #

Take all of the root files and move them into the /web/app folder. Don’t forget hidden files like .env. It doesn’t hurt to leave all those files there, but if you’re a neat freak, you can leave out everything except these:

  • .env
  • composer.json
  • composer.lock
  • craft
  • craft.bat
  • all of the folders

Now you should have only a /web directory in the root.

You can rename the /web directory to anything you like even if you’re not moving files around. A popular web root directory name is public_html. Your web server might need to be configured to point to the new name, but Craft doesn’t care.


In /web/index.php find this:

define('CRAFT_BASE_PATH', dirname(__DIR__));

Change it to this:

define('CRAFT_BASE_PATH', __DIR__.'/app');

After you test your site to make sure nothing is broken, you’re done!