Modify docroot to improve security
In a standard installation with an Apache web server, Magento is installed to the default web root: /var/www/html/magento2
.
Within the magento2
folder are:
- /pub/
- /setup/
- /var/
- other folders
The Magento app is served from /var/www/html/magento2/pub
. The rest of the Magento file system is vulnerable because it is accessible from a browser.
Setting the webroot to the pub/
directory prevents site visitors from accessing the Web Setup Wizard and other sensitive areas of the Magento file system from a browser.
This topic describes how to change the Apache docroot on an existing Magento instance to serve files from the Magento pub/
directory, which is more secure.
If you’re accustomed to using the Web Setup Wizard during development, be aware that you will not be able to access it when serving files from the pub/
directory.
The Web Setup Wizard is being deprecated in Magento 2.3.6 and will be removed in Magento 2.4.0. After it is removed, you must use the command line to install or upgrade Magento.
A note about nginx
If you are using nginx and the nginx.conf.sample
file included in the Magento installation directory, you are probably already serving files from the pub/
directory.
When used in your server block that defines your site, the nginx.conf.sample
configuration overrides your server’s docroot settings to serve files from Magento’s pub/
directory. For example, see the last line in the following configuration:
1
2
3
4
5
6
7
8
9
10
11
12
13
# /etc/nginx/sites-available/magento
upstream fastcgi_backend {
server unix:/run/php/php7.0-fpm.sock;
}
server {
listen 80;
server_name 192.168.33.10;
set $MAGE_ROOT /var/www/html/magento2ce;
include /var/www/html/magento2ce/nginx.conf.sample;
}
Before you begin
To complete this tutorial, you will need access to a working Magento installation running on a LAMP stack:
- Linux
- Apache (2.2+)
- MySQL (5.6+)
- PHP (7.1.3+ or 7.2)
- Magento (2.0+)
Refer to Prerequisites and the Installation Guide for more information.
1. Edit your server configuration
The name and location of your virtual host file depends on which version of Apache you are running. This example shows the name and location of the virtual host file on Apache v2.4.
- Log in to your Magento server.
-
Edit your virtual host file:
1
vim /etc/apache2/sites-available/000-default.conf
-
Add the path to your Magento
pub/
directory to theDocumentRoot
directive:1 2 3 4 5 6 7 8 9 10 11 12
<VirtualHost *:80> ServerAdmin webmaster@localhost DocumentRoot /var/www/html/magento2ce/pub ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined <Directory "/var/www/html"> AllowOverride all </Directory> </VirtualHost>
-
Restart Apache:
1
systemctl restart apache2
2. Update your base URL
If you appended a directory name to your server’s hostname or IP address to create the base URL when you installed Magento (for example http://192.168.33.10/magento2
), you’ll need to remove it.
Replace 192.168.33.10
with your server’s hostname.
-
Log in to the Magento database:
1
mysql -u <user> -p
-
Specify the Magento database you created when you installed Magento:
1
use <database-name>
-
Update the base URL:
1
UPDATE core_config_data SET value='http://192.168.33.10' WHERE path='web/unsecure/base_url';
3. Update the env.php file
The following node needs to be appended to the env.php
file.
1
2
3
'directories' => [
'document_root_is_pub' => true
]
Refer to the env.php reference for more information.
4. Switch modes
Magento modes, which include production
and developer
, are designed to improve security and make development easier. As the names suggest, you should switch to developer
mode when extending or customizing Magento and switch to production
mode when running Magento in a live environment.
Switching between modes is an important step in verifying that your server configuration is working properly. You can switch between modes using the Magento CLI tool:
- Go to your Magento installation directory.
-
Switch to
production
mode.1
bin/magento deploy:mode:set production
1
bin/magento cache:flush
- Refresh your browser and verify that the storefront displays properly.
-
Switch to
developer
mode.1
bin/magento deploy:mode:set developer
1
bin/magento cache:flush
- Refresh your browser and verify that the storefront displays properly.
5. Verify the storefront
Go to the storefront in a web browser to verify that everything is working.
-
Open a web browser and enter your server’s hostname or IP address in the address bar. For example, http://192.168.33.10.
The following figure shows a sample storefront page. If it displays as follows, your installation was a success!
Refer to the troubleshooting section if the page displays a 404 (Not Found) or fails to load other assets like images, CSS, and JS.
-
Try accessing the Magento directory for the Web Setup Wizard from a browser. Append “setup/” to your server’s hostname or IP address in the address bar:
If you see a 404 or the “Access denied” message, you’ve successfully restricted access to the Magento file system.