I've written a few javascripts which are meant for the admin, but I'm not sure in which folder I should place these JS files. These scripts will be embeded in the pages in the Magento admin panel.

The folders in /skin/adminhtml are accessible by anyone and I don't think that is a good place for scripts meant for admin.

In which folder should I place my JS scripts which are meant for the admin? If not, how can I place the scripts in a folder which will only be accessible in the admin panel?

  • It should be in skin/adminhtml folder Commented Aug 1, 2016 at 8:38
  • app/design/adminhtml/your-theme/default/layout/local.xml
    – Arjun
    Commented Aug 1, 2016 at 8:40
  • @PankajPareek Like I have mentioned, that folder is accessible to the public. :(
    – xenon
    Commented Aug 1, 2016 at 8:43
  • @Arjun isn't this the folder for layout.xml only?
    – xenon
    Commented Aug 1, 2016 at 8:43
  • 1
    frontend files must be in public accessible folder. As you will add files for backend so no one will know about your files. also you must have htaccess so that files list will not show on browser. Commented Aug 1, 2016 at 8:49

1 Answer 1


skin/adminhtml is the correct place. Yes, these files are publicly accessible, but if there is sensitive information in static JavaScript files, you are probably doing something wrong.

Try to move anything that should not be seen into PHTML templates. For example if you have JavaScript like this:

SecretService.prototype.init = function() {
  this.secretKey = 'abcdefg';

change it to

SecretService.prototype.init = function(key) {
  this.secretKey = key;

and move instantiation to a template:

<script type="text/javascript">
new SecretService('abcdefg');

Then you also have the advantage to be able to use PHP and get such data from the configuration instead of hard coding it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.