Can any one tell me the logical difference between of using index.php in root directory and pub directory when we go live to point domain then which index.php should be pointed by domain?
Add a comment
|
4 Answers
- Magento 2 ships with two index.php files.
/path/to/magento2/index.php
/path/to/magento2/pub/index.php
One is at the absolute top level of Magento 2’s distribution folder. The second is inside the "pub" folder. There are also separate but similar .htaccess files for each of these index.php files.
The file you want to use for your Magento system’s root folder is pub. This is a modern PHP framework convention, and is one layer in a layered approach to protecting your PHP and configuration files from being exposed to the world. However, Magento still ships with the root level index.php because many hosting companies make changing this webroot difficult and/or impossible.
Hint : https://alanstorm.com/magento-2-frontend-files-serving/
- Because in that case most of Magento's code will live outside the public document root, so the possible attack surface is smaller. In other words, when you use the top-level folder as a document root, you have to make sure that various folders (such as the app) are explicitly denied in your webserver configuration.
Magento2 uses the /index.php is mainly for the CLI commands where there is no use of media and static folders. But while you access the website, you need to point to the index.php only. Because the media paths were defined only in pub/index.php.
Magento 2 generally use /index.php in root file. But when you will go live and change the mode to production Magento will use pub/index.php.
-
this doesn't work on magento 2.2.3 , after changing mode to production it still uses root index.php file. Commented Oct 25, 2018 at 7:40
-
This statement is incorrect. The server configuration, whether that's nginx or apache2 or something else, is responsible for which index.php is used. See @pradeep-thakur's answer for a better explanation.– JinnKoCommented Dec 28, 2020 at 15:31
In magento 2 root/index.php and pub/index.php both index.php are entry points and they are reusing the same app/bootstrap.php
- The pub/index.php -- if you are able to configure the "pub" directory as the document root on Server.
- In order to run a Magento 2 web application, the "pub" directory is the only one that's necessary to expose.
- The rest you can hide (typically for security reasons, to avoid accidental exposing local.xml or something like that).
- It is more secure than root.
-
If our folder permissions are right then what security can be leaked due to using root index.php? Commented Sep 20, 2018 at 10:48