I noticed in default.settings.php this comment:

Location of the site configuration files.

The $config_directories array specifies the location of file system directories used for configuration data. On install, "active" and "staging" directories are created for configuration. The staging directory is used for configuration imports; the active directory is not used by default, since the default storage for active configuration is the database rather than the file system (this can be changed; see "Active configuration settings" below).

The default location for the active and staging directories is inside a randomly-named directory in the public files path; this setting allows you to override these locations. If you use files for the active configuration, you can enhance security by putting the active configuration outside your document root.

And then the example:

$config_directories = array(
  CONFIG_ACTIVE_DIRECTORY => '/some/directory/outside/webroot',
  CONFIG_STAGING_DIRECTORY => '/another/directory/outside/webroot',

I also noticed that when you export to the directory you specify, an .htaccess file is added that denies access to the directory.

I understand that most people will not want their configuration available for anyone to read, but what if your site is in a public repository?


Is there anything I should be concerned about? Could this data be used to exploit the site?

1 Answer 1


Well, it contains the complete configuration, like list of modules, views, roles and their permissions.

While those things are not directly sensitive, it would make it easy to check for misconfigurations for example, views that aren't access protected, roles that have administrative permissions and so on.

I'm not sure if core adds anything that is explictly sensitive in there, I don't know any examples.

It does depend on the modules you have installed though. Many sites store API Keys or passwords, when integrating with third party services. Those would also be stored in configuration. For example configuration to send mails through an SMTP server or username/password for a Solr server. And you don't want to have that public.

But you probably also don't want those in git in the first place. You can solve that by setting them through configuration overrides in settings.php.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.