Placing Drupal core/modules code outside public_html

Question

I've been trying to improve my sites security as I build a Drupal 8 update for my page. One thing I've seen recently is keeping your core code outside the web accessible docroot folder. I've also heard about keeping a copy of the code setup on git so you can easily bring down a clean copy if somehow someone changes something.

What is the current best practice for such a thing? On my server I have an account for the page, within which is public_html where anything actually being sent out to the world is kept. Is it possible to have the Drupal code one level down and then have things run from public_html?

Answer 1

There is some work being done to move as much of core out of DOCROOT, but this is complicated by assets that need to be web accessible, mainly JS, CSS, and images. So, moving core/modules outside DOCROOT is tough because many of those have all three.

Current thinking is to place the vendor directory outside of DOCROOT to help reduce attack surface area. Since using composer for all site building is also essentially a best practice now, the drupal-composer/drupal-project template does this, and also will place modules, themes, libraries, and other Drupal stuff in the proper place, while keeping vendor non-web accessible, as it contains the non-Drupal specific dependencies.

Answer 2

You just move your code into under public_html folder with the same permissions.