# Is this secure salt and password above htdocs or www

**URL:** <https://discourse.cakephp.org/t/is-this-secure-salt-and-password-above-htdocs-or-www/2386>\
**Category:** Uncategorized\
**Created:** [April 9, 2017, 8:27pm UTC](https://discourse.cakephp.org/t/is-this-secure-salt-and-password-above-htdocs-or-www/2386 "2017-04-09T20:27:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jimgwhit](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/jimgwhit/32/378_2.png) [@jimgwhit](https://discourse.cakephp.org/u/jimgwhit)\
**Post date:** [April 9, 2017, 8:27pm UTC](https://discourse.cakephp.org/t/is-this-secure-salt-and-password-above-htdocs-or-www/2386/1 "2017-04-09T20:27:19Z")

</div>

Well I didn’t find a way to move cakephp above (www, htdocs, etc)  
Please refer to [Remove cakephp 3.4 from webroot how to](http://discourse.cakephp.org/t/remove-cakephp-3-4-from-webroot-how-to/2335/2)

I did however:

- Made a folder above htdocs (even with apache) named cake34up
- Put tmp\cache in that folder
- Put logs there also
- Created a file to house the salt and db password named salt.php

Now in cakephp (the folder inside htdocs) in the configs I,

```auto
include ROOTUP . "salt.php";

```

in paths

```auto
///paths.php

define('DIR', '/cakephp/'); //at bottom
/**
 * Path to the temporary files directory.
 */
define('TMP', ROOTUP . DS . 'tmp' . DS);

/**
 * Path to the logs directory.
 */
define('LOGS', ROOTUP . 'logs' . DS);

/**
 * Path to the cache files directory. It can be shared between hosts in a multi-server setup.
 */
define('CACHE', TMP . 'cache' . DS);
//////do cache also///////////////////////

```

in index

```auto
index.php
define('ROOTUP', realpath( __DIR__. '/../../../cake34up') . DIRECTORY_SEPARATOR);

```

in app

```auto
app
            'username' => 'root',
            'password' => $password,
            'database' => 'tjhs2',
            'encoding' => 'utf8',
            'timezone' => 'UTC',
            'flags' => [],
            'cacheMetadata' => true,
            'log' => false,

```

Notice I use $password, which I get from cake34up.

So the secure items are housed in cake34up, please let me know if this is secure. Seems cake is fairly secure anyway, but just some extra precautions.

---

<div class="post-metadata">

**Author:** ![fiblan](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/fiblan/32/594_2.png) [@fiblan](https://discourse.cakephp.org/u/fiblan)\
**Post date:** [April 11, 2017, 10:13am UTC](https://discourse.cakephp.org/t/is-this-secure-salt-and-password-above-htdocs-or-www/2386/2 "2017-04-11T10:13:56Z")

</div>

Subfolder install & security in production? 😕 I don’t really like, ok in test or development environment but not in production. If your needs is use subfolders, you can move stuff above document root, but this, imho, not introduce security improvements.

Instead an important precaution (git based projects) against spreading salt, password… is add

- config/app.php
- tmp/\*

in .gitignore

> <https://github.com/github/gitignore/blob/master/CakePHP.gitignore>

---

<div class="post-metadata">

**Author:** ![jimgwhit](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/jimgwhit/32/378_2.png) [@jimgwhit](https://discourse.cakephp.org/u/jimgwhit)\
**Post date:** [April 11, 2017, 4:46pm UTC](https://discourse.cakephp.org/t/is-this-secure-salt-and-password-above-htdocs-or-www/2386/3 "2017-04-11T16:46:24Z")

</div>

@fiblan that was my original question, I cannot see a way to point the public part of an install to a higher folder, see  
[Remove cakephp 3.4 from webroot how to](http://discourse.cakephp.org/t/remove-cakephp-3-4-from-webroot-how-to/2335/2) for original question. Seems older versions you could.

---

<div class="post-metadata">

**Author:** ![fiblan](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/fiblan/32/594_2.png) [@fiblan](https://discourse.cakephp.org/u/fiblan)\
**Post date:** [April 11, 2017, 10:49pm UTC](https://discourse.cakephp.org/t/is-this-secure-salt-and-password-above-htdocs-or-www/2386/4 "2017-04-11T22:49:51Z")

</div>

[I replied](http://discourse.cakephp.org/t/remove-cakephp-3-4-from-webroot-how-to/2335/4?u=fiblan) in your original question