Remove cakephp 3.4 from webroot how to


The documentation does not cover this. How do you remove cakephp from webroot (server webroot, not talking about cakephp webroot), having only the public files under webroot. By webroot I mean, lets us laravel as example and what is done

Here is sample folder structure +++++= a subfolder


in other words htdocs/larpubfolder

so laravel51 is main files out of webroot (htdocs is webroot in apache), directly under apache2

And in larpubfolder is the .htaccess and index.php file

Now how to do this for cakephp 3.4 and what files need modified?

As unbelievable as it sounds, there is nothing on the web about properly moving cakephp (not old version) out of webroot.

Here is laravel example:

Mainly what files to modify and how?


this is a method i’ve been using since cakePHP 1.2 daze - of course YMMV:


  • these are my NTS (Notes To Self), as such they are changing over time and you MUST intelligently scan and make changes to suit your own local folder/file structure

  • i have not looked at this in about a year, so i cannot speak to changes since then that may break it

  • pay attention to [xxx NEED CONFIRM xxx] *** [/xxx NEED CONFIRM xxx] tags where i have not followed thru with full testing of an idea.

  • most of the time i will include variable parts inside square brackets, i.e., [ver] for multiple versions of cake

  • step 3) is my trace of sorting out paths and the like, i present it this way (rather than simply spelling out changes) to show HOW i sorted things out - THESE ARE EXAMPLES, change to suit your environment. that said, i do list required changes made by listing the error, commenting out the original line and adding the modified line

  • some error logs may be in different places as stated in your php.ini and httpd.conf files

    install cakePHP in alternate directory structure to allow separation of cakebase and application and webroot.

    • assuming all server apps - including composer - working

    • say you have a setup like this:
      | ±–app000
      | ±–app1
      | ±–app1dev
      | ±–app2
      | —app2dev
      | —mysql
      | ±–app000
      | ±–app1
      | ±–app1dev
      | ±–app2
      | —app2dev
      | ±–apache
      | ±–cake
      | | ±–cake000
      | | ±–cake3.1
      | | ±–cake3.2
      | ±–composer
      | | —cache
      | ±–mysql
      | ±–php
      | —pma

      • /www/pub is apache doc root and the ONLY public access point
      • /www/pub is where each application webroot will go as /www/pub/app[ver]
      • /www/apps is where each application core will go as /www/apps/app[ver]
      • /www/tmp/logs is where server logs will go - ONLY AFTER you have changed your php.ini and httpd.conf to make it so
      • /www/serv/cake/cake[ver] is where cakePHP core will live and be the central project in the composer sense
        • this way you can simulutaneously work on dev AND stable branches of BOTH toolset(s) and application(s) [or homepage(s), or project(s), or . . .]
        • comfortable with my old setup, easier for me to get head around multiple projects with more than one dependant on each [ver] of cakePHP
        • allow me to work behind restricted corporate environment
        • can still use composer to update all focused on cake[ver] – OFF SITE if have to, with ALL plugins and vendors slave to the cakePHP, then
          [xxx NEED CONFIRM xxx]
          ALL of /www/serv/cake/cake[ver]/plugins and vendors can be entirely overwritten or built in a new cake[ver] with minor diffs on select config, apps/app[ver] and pub/app[ver] files only
          [/xxx NEED CONFIRM xxx]
          • i know, i know, i know, i know - six of one half dozen of other
        • learning MUCH about cakePHP 3.0 and composer and git and . . .

    – 1) copy composer download into tree

    • initial composer.json created in /www/serv/cake/cake[ver]/ with all cakePHP dependencies i chose
    • run composer in /www/serv/cake/cake[ver]/
    • move /www/serv/cake/cake[ver]/vendor/cakephp/app/* to /www/apps/app[ver]/
      • folder can be left behind - will be used for upgrades anyway
    • move /www/serv/cake/cake[ver]/vendor/cakephp/cakephp/* to /www/serv/cake/cake[ver]/
      • EXCEPT composer.json, rename to composer-cakePHP.json then move with rest
      • folder can be left behind - will be used for upgrades anyway
    • move /www/apps/app[ver]/webroot/* to /www/pub/app[ver]/
      • delete /www/apps/app[ver]/webroot/ folder
      • create /www/pub/index.php containing only ‘<?php phpinfo();’

    – 2) start php server in public access folder

    • cd /d /www/pub
    • php -S localhost:8000

    – 3) open browser, begin debugging [AS EXAMPLES ONLY --> find your logs]

    • open browser at localhost:8000 --> should see output of phpinfo() from pub/index.php

    • open browser at localhost:8000/app000/ --> begin debugging output:

      • read /www/tmp/errors_php.log

        • PHP Fatal error: require(): failed opening required ‘D:/www/pub/config/bootstrap.php’ (include_path=’.;C:/php/pear’) in D:/www/pub/app000/index.php on line 27
        • change D:/www/pub/app000/index.php line 27:
          // require dirname(DIR) . ‘/config/bootstrap.php’;
          require dirname(dirname(DIR)) . ‘/apps/’ . basename(DIR) . ‘/config/bootstrap.php’;
      • read /www/tmp/errors_php.log

        • PHP Fatal error: require(): Failed opening required ‘D:/www/apps/app000/vendor/autoload.php’ (include_path=’.;C:/php/pear’) in D:/www/apps/app000/config/bootstrap.php on line 23
        • change D:/www/apps/app000/config/paths.php line 78:
          // define(‘CAKE_CORE_INCLUDE_PATH’, ROOT . DS . ‘vendor’ . DS . ‘cakephp’ . DS . ‘cakephp’);
          define(‘CAKE_CORE_INCLUDE_PATH’, dirname(dirname(ROOT)) . ‘/serv/cake/cake000’);
        • change D:/www/apps/app000/config/paths.php line 51:
          // define(‘WWW_ROOT’, ROOT . DS . ‘webroot’ . DS);
          define(‘WWW_ROOT’, $_SERVER[“DOCUMENT_ROOT”] . DS . basename(dirname(DIR)) . DS);
      • read /www/tmp/errors_php.log

        • Fatal error: require(): Failed opening required ‘D:/www/serv/cake/cake000/vendor/cakephp/cakephp/src/Core/functions.php’ (include_path=‘D:/www/serv/cake/cake000/vendor/phpunit/php-text-template;. . .;.;C:/php/pear’) in D:/www/serv/cake/cake000/vendor/composer/autoload_real.php on line 58

        • change D:/www/serv/cake/cake000/vendor/composer/autoload_files.php lines 5 ,10, 11, 12
          // $vendorDir = dirname(dirname(FILE));
          $vendorDir = dirname(DIR);

          // $vendorDir . ‘/cakephp/cakephp/src/Core/functions.php’,
          // $vendorDir . ‘/cakephp/cakephp/src/Collection/functions.php’,
          // $vendorDir . ‘/cakephp/cakephp/src/I18n/functions.php’,
          $baseDir . ‘/src/Core/functions.php’,
          $baseDir . ‘/src/Collection/functions.php’,
          $baseDir . ‘/src/I18n/functions.php’,

        • change D:/www/serv/cake/cake000/vendor/composer/autoload_psr4.php lines 5, 19, 23
          // $vendorDir = dirname(dirname(FILE));
          $vendorDir = dirname(DIR);

          // ‘Cake\’ => array($vendorDir . ‘/cakephp/cakephp/src’),
          ‘Cake\’ => array($baseDir . ‘/src’),

          // ‘App\’ => array($vendorDir . ‘/cakephp/app/src’),
          ‘App\’ => array(APP),

      • read /www/tmp/errors_php.log

      • read browser output

        • Could not load configuration file: D:/www/apps/app000/config/app.php
        • copy app000/config/app.default.php to app.php
      • read /www/tmp/errors_php.log

      • read browser output

        • Error: The application is trying to load a file from the Migrations plugin. Make sure your plugin Migrations is in the D:/www/apps/app000/plugins/ directory and was loaded.
        • change app000/config/app.php
          // ‘plugins’ => [ROOT . DS . ‘plugins’ . DS],
          ‘plugins’ => [CORE_PATH . DS . ‘plugins’ . DS],
      • read www/apps/app000/logs/error.log

        • 2015-02-02 03:47:59 Warning: DebugKit not enabled. You need to either install pdo_sqlite, or define the “debug_kit” connection name.
        • change php.ini
          • uncomment extension=php_pdo_sqlite.dll
          • restart apache
        • Notice (1024): Please change the value of ‘Security.salt’ in ROOT/config/app.php to a salt value specific to your application.
        • change ROOT/config/app.php
          // ‘salt’ => ‘SALT’,
          ‘salt’ => ‘xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx’,

    – 4) establish database connection

    • read browser output
      • Connection to database could not be established . . .
      • in mysql create empty database named app000
      • change app000/config/app.php
        • in ‘Datasources’ => [ ‘default’ => [
          // ‘username’ => ‘my_app’,
          // ‘password’ => ‘secret’,
          // ‘database’ => ‘my_app’,
          ‘username’ => ‘xxxxxxxx’,
          ‘password’ => ‘xxxxxxxx’,
          ‘database’ => basename(ROOT),

        • in ‘Datasources’ => [ ‘test’ => [
          // ‘username’ => ‘my_app’,
          // ‘password’ => ‘secret’,
          // ‘database’ => ‘my_app’,
          ‘username’ => ‘xxxxxxxx’,
          ‘password’ => ‘xxxxxxxx’,
          ‘database’ => ‘test_’ . basename(ROOT),

      • if timezone raises error
      • if restarting mysql fails
        • start task manager > processes, enable ‘Show processes from all users’, right-click ‘mysqld.exe’, ‘End Process Tree’
        • delete /www/data/mysql/ib_logfile*

    – 5) NOW, updates can be accomplished with normal composer methods on /www/serv/cake/cake000
    + ONLY FILES to be careful with so far are:
    [xxx NEED CONFIRM xxx]
    - except for these files and apps/app[ver]/src, ALL of cake000, apps/app000 and pub/app000 may be overwritten with updates
    [/xxx NEED CONFIRM xxx]
    - if unsure, diff all folders/files and select changes desired – WITHOUT compromising eight listed files.

    – 5) keep apps/app000 and pub/app000 clean and dont modify further,
    + use as base template to copy to other ‘apps’, and bake against actual database in new locations.
    i.e. copy apps/app000 and pub/app000 to apps/app1 and pub/app1, apps/app2 and pub/app2, etc.,
    + when copy/pasting from cookbook pdf watch out for back-quotes -’-, ALL MUST be replaced with single quote -’-.

    – 6) copy apps/app000 and pub/app000 to apps/bmk and pub/bmk and bake bookmarker tutorial

    • files modified pt1:
      • config/app.php
      • src/Model/Entity/User.php
      • config/routes.php
      • src/Controller/BookmarksController.php
      • src/Model/Table/BookmarksTable.php
      • src/Template/Bookmarks/tags.ctp
    • files modified pt2:
      • src/Controller/AppController.php
      • src/Controller/UsersController.php
      • src/Template/Users/login.ctp
      • src/Model/Table/BookmarksTable.php
      • src/Controller/BookmarksController.php
      • src/Template/Layouts/default.ctp
      • src/Template/Bookmarks/add.ctp
      • src/Model/Entity/Bookmark.php
    • ??? duplicate tut changes on rest of controllers ???

    [note]DJT: some useful debug outputs i’ve used

    <?php print_r( "full dir holds App, WO / ::::::::::::::::::: ROOT :: " . ROOT . "" ); ?>
    <?php print_r( "actual dir name for App ::::::::::::::::: APP_DIR :: " . APP_DIR . "" ); ?>
    <?php print_r( "applications dir :::::::::::::::::::::::::::: APP :: " . APP . "" ); ?>
    <?php print_r( "config dir ::::::::::::::::::::::::::::::: CONFIG :: " . CONFIG . "" ); ?>
    <?php print_r( "webroot dir :::::::::::::::::::::::::::: WWW_ROOT :: " . WWW_ROOT . "" ); ?>
    <?php print_r( "tests dir ::::::::::::::::::::::::::::::::: TESTS :: " . TESTS . "" ); ?>
    <?php print_r( "temporary files dir ::::::::::::::::::::::::: TMP :: " . TMP . "" ); ?>
    <?php print_r( "logs dir ::::::::::::::::::::::::::::::::::: LOGS :: " . LOGS . "" ); ?>
    <?php print_r( "cache files dir ::::::::::::::::::::::::::: CACHE :: " . CACHE . "" ); ?>
    <?php print_r( "abs cake dir path, WO / :: CAKE_CORE_INCLUDE_PATH :: " . CAKE_CORE_INCLUDE_PATH. "" ); ?>
    <?php print_r( "cake dir :::::::::::::::::::::::::::::: CORE_PATH :: " . CORE_PATH . "" ); ?>
    <?php print_r( "cake dir ::::::::::::::::::::::::::::::::::: CAKE :: " . CAKE . "" ); ?>
    <?php // print_r(""); print_r( ); print_r(""); ?>
    <?php // print_r(""); print_r( ); print_r(""); ?>
    <?php // print_r(""); print_r( ); print_r(""); ?>


    [note]DJT: always use / directory separator, not \ because php handles both well --> no need for DS declaration – i think even windoze 7+ does correctly until you touch some limited tool in process chain

Is this secure salt and password above htdocs or www
Is this secure salt and password above htdocs or www

@McScreech Thanks for answer, I had even saw something similar on stackoverflow where they had changed bootstrap locale

require dirname(dirname(__DIR__)) . '/apps/' . basename(__DIR__) . '/config/bootstrap.php';

But the later versions don’t have such a call: here is the index.php

if (php_sapi_name() === 'cli-server') {
    $_SERVER['PHP_SELF'] = '/' . basename(__FILE__);

    $url = parse_url(urldecode($_SERVER['REQUEST_URI']));
    $file = __DIR__ . $url['path'];
    if (strpos($url['path'], '..') === false && strpos($url['path'], '.') !== false && is_file($file)) {
        return false;
require dirname(__DIR__) . '/../../cake34up/vendor/autoload.php';

use App\Application;    ///////////These 2 lines mess things up as main cakephp is in higher folder
use Cake\Http\Server;

// Bind your application to the server.
$server = new Server(new Application(dirname(__DIR__) . '/../../cake34up/config'));

// Run the request/response through the application
// and emit the response.

As you can see I tryed to repoint to the vendor and config folder, get nothing but a 500 error.
I will go through your answer and try again, thanks.

I wish cakephp had a simple index.php thay you could just point to main install with

/../../then whatever here


i don’t like it… but you can change constant CAKE_CORE_INCLUDE_PATH in app/config/paths.php

Is this secure salt and password above htdocs or www

I had tried changing values in paths. But the above index file is the very first loaded file, can’t get around those two use statements.


It’s right there in the documentation:


@dakota jimgwhit wants a single vendor directory for multiple cake applications


You also have to change webroot/index.php (vendor path)


That is a very very bad idea and will do nothing but cause issues in the future. You want a separate vendor directory for each application, otherwise you’ll always struggle with upgrading dependencies. Storage space is cheap :slight_smile:


No it’s one application, I just want to move main files out of htdocs. Like a laravel install for security.
The folder structure from docs shows

    webroot/ //////Only folder I want under htdocs all other above htdocs.

Main cake is under htdocs, it looks like.

I want webroot (the cake one) under htdocs and main cake files out of htdocs one folder higher “even” with apache folder. Seems there would be good instructions on this somewhere.


Why can’t you change DocumentRoot to webroot as written in the documentation and remembered by dakota?

In production, with Apache, the best solution is already described in The Cookbook but if you must (?) mantain DocumentRoot to htdocs… install cake out htdocs and use Alias directive to map webroot.