I want to be confident that access to my Magento 1 code bases is restricted.

I have:

  1. created a folder in my Magento root directory named public
  2. moved .htaccess to public/.htaccess
  3. created public/index.php

  4. and created symbolic links of public/js, public/skin, and public/media

This setup isn't much different than creating a new Magento website in a multi-site setup. Is there anything else I should be considering?

1 Answer 1



  • Instead of moving .htaccess you could also symlink it
  • Same goes for index.php
  • On top of the folders you mentionned, I would add favicon.ico, errors folder and sitemaps folder.

Edit: depending if you use them or not, you could add get.php as well as api.php

  • Thanks for the suggestion. To confirm, this does appear to offer greater security. Oct 31, 2016 at 3:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.