The Private Files directory is outside of the sites/default/files directory.
Is that fine? I haven't got any problem with that, yet.
I'm using Drupal 7, if that makes any difference.
Drupal Answers is a question and answer site for Drupal developers and administrators. It only takes a minute to sign up.
Sign up to join this communityThe Private Files directory is outside of the sites/default/files directory.
Is that fine? I haven't got any problem with that, yet.
I'm using Drupal 7, if that makes any difference.
TL;DR - It is okay even if you place the private files directory outside the sites/default/files
directory. In fact, it is recommended that you keep it outside the Drupal root (source). This is hard to implement on shared hosting.
More explaination:
When you specify the path of the private files in Drupal's configuration, Drupal places a .htaccess
file with Deny to All
in it. Which means that Apache will not be able to serve any of the files inside that directory. The files inside the directory can only be served by Drupal and their paths are resolved as Drupal path.
Example: Let us compare how placing the same file in public and private directory changes the way Drupal handles it. Say the filename is brochure.pdf
:
brochure.pdf
in public directory with path sites/default/files
. And in the browser you hit http://yoursite.com/sites/default/files/brochure.pdf
.brochure.pdf
in private directory with path sites/default/files/private
. And in the browser you hit http://yoursite.com/sites/default/files/private/brochure.pdf
.Deny to All
. It passes on the request to Drupal. Drupal then does the access checks as it does on all other menus (routes in D8), with access callback
.So, to summarize, it should be okay to place your private directory outside the public files.
Note: If you are hosting your site on other servers and not Apache, you might need to check if you need some extra settings as .htaccess
restrictions might not work with them.