I am using Magento 2.3.1 Open Source. I installed it from the .zip file in the public_html folder (I didn't know any better at the time) in my account at my web host, running on Apache.
I did the Magento Security Scan on my website, and it showed the following problem-
Your Web server is configured to run Magento from %MAGENTO_ROOT% directory.
It is recommended to set %MAGENTO_ROOT%/pub as a Web server root directory.
In response I found my way to this page
https://devdocs.magento.com/guides/v2.3/install-gde/tutorials/change-docroot-to-pub.html
which had instructions to fix the problem, but they seem to only apply to installations that are not on shared web hosting plans.
I tried to find the files that contain the document root url through SSH-ing into the shared server just in case, but since I don't have root access it didn't show.
I contacted my hosting provider twice to change the document root for me through /var/cpanel/userdata/username/example.com
, but since there is a language barrier, they told me that that was beyond their expertise, or something like that.
My site is run under https, of course, if that helps any.
I am not too security savvy with Magento, so what I want to know is, if I use the .htaccess commands below to change the document root, would they alone make my Magento installation in public_html secure?-
RewriteEngine on
RewriteBase /
RewriteCond %{REQUEST_URI} !^/pub/
RewriteCond %{HTTP_HOST} ^(www\.)?example\.
RewriteRule ^(.*)$ /pub/$1 [L]
Do I need to move/copy any Magento files from public_html to public_html/pub if I use the .htaccess commmands above, if so, which files?
If I leave the Magento files in public_html and use the rewrite commands, will that be a security problem?
Do I need to change any settings in the Magento Admin after using the rewrite commands?
Thank you very much.
/pub/
and you have working site its ok, magento can work from two web rootsDocumentRoot
to avoid any issues with rewrites.