Can any one tell me the logical difference between of using index.php in root directory and pub directory when we go live to point domain then which index.php should be pointed by domain?

up vote 3 down vote accepted
  1. Magento 2 ships with two index.php files.

/path/to/magento2/index.php

/path/to/magento2/pub/index.php

  • One is at the absolute top level of Magento 2’s distribution folder. The second is inside the "pub" folder. There’s also separate but similar .htaccess files for each of these index.php files.

  • The file you want to use for your Magento system’s root folder is pub. This is a modern PHP framework convention, and is one layer in a layered approach to protecting your PHP and configuration files from being exposed to the world. However, Magento still ships with the root level index.php because many hosting companies make changing this web root difficult and/or impossible.

Hint : https://alanstorm.com/magento-2-frontend-files-serving/

  1. Because in that case most of Magento's code will live outside the public document root, so the possible attack surface is smaller. In other words, when you use the top level folder as document root, you have to make sure that various folders (such as app) are explicitly denied in your webserver configuration.

Hint : Why Magento 2 have 2 possible root folder?

Magento2 uses the /index.php is mainly for the CLI commands where there is no use of media and static folders. But while you access the website, you need to point to the index.php only. Because the media paths were defined only in pub/index.php.

Magento 2 generally use /index.php in root file. But when you will go live and change the mode to production Magento will use pub/index.php.

  • this doesn't work on magento 2.2.3 , after changing mode to production it still uses root index.php file. – Naveed Asim Oct 25 at 7:40

In magento 2 root/index.php and pub/index.php both index.php are entry points and they are reusing the same app/bootstrap.php

  • The pub/index.php -- if you are able to configure the "pub" directory as the document root on Server.
  • In order to run a Magento 2 web application, the "pub" directory is the only one that's necessary to expose.
  • The rest you can hide (typically for security reasons, to avoid accidental exposing local.xml or something like that).
  • It is more secure than root.

Hint : https://github.com/magento/magento2/issues/356

  • If our folder permissions are right then what security can be leaked due to using root index.php? – Charul Tyagi Sep 20 at 10:48

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.